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Highlights 

Highlights  of  GAO-15-463,  a  report  to  the 
Committee  on  Armed  Services.  House  of 
Representatives 


Why  GAO  Did  This  Study 

A  congressional  panel  examined  the 
capacity  of  DOD's  financial 
management  system  for  providing 
timely,  reliable,  and  useful  information 
for  decision  making  and  reporting.  The 
panel,  in  its  January  2012  report, 
included  29  recommendations 
addressed  to  DOD  in  four  areas; 

(1)  FIAR  strategy  and  methodology, 

(2)  challenges  to  achieving  financial 
management  reform  and  auditability, 

(3)  financial  management  workforce, 
and  (4)  enterprise  resource  planning 
systems  implementation. 

GAO  was  asked  to  review  the  status  of 
DOD’s  actions  to  implement  these 
recommendations.  This  report 
examines  the  extent  to  which  the 
recommendations  have  been 
implemented.  GAO  reviewed  pertinent 
legislation,  including  the  National 
Defense  Authorization  Acts  for  Fiscal 
Years  2010  through  2015  as  well  as 
the  department’s  FIAR  Guidance  and 
FIAR  Plan  Status  Reports.  GAO 
analyzed  relevant  information  and 
interviewed  officials  from  the  Office  of 
the  Secretary  of  Defense,  the  military 
departments,  and  two  service 
providers.  Using  the  three  status 
categories  developed  for  GAO’s  high- 
risk  work — met,  partially  met,  and  not 
met — GAO  determined  the  extent  to 
which  DOD  implemented  the  panel’s 
recommendations. 

What  GAO  Recommends 

GAO  is  recommending  that  DOD 
reconsider  the  status  of  three  panel 
recommendations  that  it  determined  to 
be  met  but  that  GAO  determined  to  be 
only  partially  met.  DOD  concun'ed  with 
the  recommendation  and  described 
planned  actions  to  address  it. 


View  GAO-15-463.  For  more  information, 
contact  Asif  A.  Khan  (202)  512-9869  or 
khana@gao.gov. 


DOD  FINANCIAL  MANAGEMENT 

Continued  Actions  Needed  to  Address  Congressional 
Committee  Panel  Recommendations 


What  GAO  Found 

The  Department  of  Defense  (DOD)  has  made  progress  toward  implementing 
each  of  the  29  recommendations  made  by  the  House  Armed  Services  Committee 
Panel  on  Defense  Financial  Management  and  Auditability  Reform  (the  panel). 
GAO  determined  that  DOD’s  actions  met  6  of  the  panel’s  recommendations  and 
partially  met  the  other  23.  In  its  May  2015  Financial  Improvement  and  Audit 
Readiness  (FIAR)  Plan  Status  Report,  DOD  reported  that  9  recommendations 
were  met  and  20  were  partially  met.  The  3  recommendations  for  which  GAO 
disagreed  with  DOD’s  reported  status  of  met  related  to  (1)  attestations  on  audit 
readiness  in  each  of  the  FIAR  Plan  Status  Reports;  (2)  inclusion  of  FIAR-related 
goals  in  Senior  Executive  Service  performance  plans,  and  rewarding  and 
evaluating  performances  over  time  based  on  those  goals;  and  (3)  the  review  of 
audit  readiness  assertions  by  component  senior  executive  committees.  For 
example,  while  each  FIAR  Plan  Status  Report  is  coordinated  among  FIAR 
Governance  Board  (Board)  members,  including  the  Comptroller/Chief  Financial 
Officer  among  others,  in  these  reports  Board  members  do  not  explicitly  attest  to 
whether  DOD  is  on  track  to  achieve  audit  readiness  in  2017  as  called  for  by  the 
panel’s  recommendation  and  not  all  Board  members  provide  signed  statements 
about  component  audit  readiness  in  the  reports. 

GAO  and  DOD  agree  that  the  remaining  20  recommendations  were  partially  met 
and  continued  actions  are  needed,  but  GAO  found  that  additional  actions  are 
needed  to  address  some  recommendations.  These  20  partially  met 
recommendations  cover  such  diverse  topics  as  a  strategy  for  the  consolidation  of 
component  financial  information,  valuation  of  historical  asset  costs,  and 
assessing  the  competencies  of  the  civilian  financial  management  workforce.  For 
example,  DOD  has  made  progress  in  assessing  the  competencies  of  its  civilian 
financial  management  workforce  in  the  financial  management  community,  but 
has  not  yet  assessed  the  competencies  of  all  civilian,  military,  and  contracted 
personnel  perfonning  financial-related  functions,  as  recommended  by  the  panel. 
Other  recommendations  are  related  to  the  implementation  of  enterprise  resource 
planning  systems — automated  systems  that  perfonn  a  variety  of  business-related 
financial  management  tasks.  DOD  officials  have  stated  that  these  systems  are 
critical  to  DOD’s  ability  to  achieve  audit  readiness,  but  none  of  these 
recommendations  have  been  fully  met. 

The  panel’s  report  and  its  recommendations  touch  on  some  of  the  most  critical 
challenges  DOD  faces  in  achieving  lasting  financial  management  improvements 
and  financial  statement  audit  readiness.  However,  it  is  important  to  note  that 
implementation  of  the  panel’s  recommendations  may  not  include  all  of  the 
actions  needed  for  DOD  to  achieve  auditable  financial  statements.  As  auditors 
perform  examinations  and  audits,  they  may  identify  deficiencies  that  were  not 
previously  known  and  therefore  were  not  addressed  by  the  panel’s 
recommendations.  DOD  is  monitoring  its  progress  for  implementing  the  FIAR 
Plan  against  interim  milestones  included  in  its  April  2015  FIAR  Guidance. 
However,  as  the  audit  readiness  date  approaches,  DOD  has  emphasized 
asserting  audit  readiness  by  set  dates  over  assuring  that  processes,  systems, 
and  controls  are  effective,  reliable,  and  sustainable.  While  time  frames  are 
important  for  measuring  progress,  DOD  should  not  lose  sight  of  the  ultimate  goal 
of  implementing  lasting  financial  management  reform,  among  other  things,  to 
ensure  that  it  can  routinely  generate  reliable,  auditable  financial  information. 
_ United  States  Government  Accountability  Office 
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Abbreviations 

ADA 

Antideficiency  Act 

CAP 

corrective  action  plan 

CMC 

Chief  Management  Officer 

CPA 

certified  public  accountant 

DCMO 

Deputy  Chief  Management  Officer 

DEAMS 

Defense  Enterprise  Accounting  and  Management  System 

DFAS 

Defense  Finance  and  Accounting  Service 

DLA 

Defense  Logistics  Agency 

DOD 

Department  of  Defense 

ECSS 

Expeditionary  Combat  Support  System 

ERP 

enterprise  resource  planning 

FIAR 

Financial  Improvement  and  Audit  Readiness 

FIP 

financial  improvement  plan 

FMR 

Financial  Management  Regulation 

GCSS-Army 

Global  Combat  Support  System-Army 

GFEBS 

General  Fund  Enterprise  Business  System 

HASC 

House  Armed  Services  Committee 

IG 

Inspector  General 

I  PA 

independent  public  accountant 

MDA 

Milestone  Decision  Authority 

NDAA 

National  Defense  Authorization  Act 

OT&E 

Operational  Test  and  Evaluation 

SBR 

Statement  of  Budgetary  Resources 

SES 

Senior  Executive  Service 

SSAE 

Statement  on  Standards  for  Attestation  Engagements 

USD(C) 

Under  Secretary  of  Defense  (Comptroller) 
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U.S.  GOVERNMENT  ACCOUNTABILITY  OFFICE 


September  28,  2015 

The  Honorable  Mac  Thornberry 
Chairman 

The  Honorable  Adam  Smith 
Ranking  Member 
Committee  on  Armed  Services 
House  of  Representatives 

Sound  financial  management  practices  and  reliable,  timely  financial 
information  are  important  to  ensuring  accountability  over  the  Department 
of  Defense’s  (DOD)  extensive  resources.  Achieving  this  goal  is  a 
significant  challenge  given  the  worldwide  scope  of  DOD’s  mission  and 
operations;  the  diversity,  size,  and  culture  of  the  organization;  and  its 
reported  trillions  of  dollars  in  assets  and  liabilities  and  its  hundreds  of 
billions  of  dollars  in  annual  appropriations.  Serious,  continuing  financial 
management  problems  at  DOD  have  precluded  it  from  producing  financial 
statements  that  can  be  audited.  To  enhance  its  oversight  of  DOD  financial 
management,  in  July  201 1 ,  the  House  Armed  Services  Committee 
(HASC)  appointed  seven  of  its  members  to  a  newly  formed  Panel  on 
Defense  Financial  Management  and  Auditability  Reform  (hereafter 
referred  to  as  the  panel).  The  panel  was  asked  to  examine  the  capacity  of 
DOD’s  financial  management  system  for  providing  timely,  reliable,  and 
useful  information  for  decision  making  and  reporting.''  In  addition,  the 
panel  was  to  identify  possible  ways  for  DOD  to  improve  its  financial 
management  and  audit  readiness  effort. 

As  part  of  its  6-month  review,  the  panel  held  seven  hearings  and  two 
briefings  on  issues  related  to  DOD  financial  management.^  In  January 
2012,  the  panel  issued  its  report  with  30  recommendations.^  Of  the  30 


^The  panel  defined  DOD’s  financial  management  system  as  the  processes  (whether 
automated  or  manual)  for  initiating,  authorizing,  recording,  and  reporting  DOD’s  operations 
and  activities  and  for  maintaining  accountability  for  the  related  assets,  liabilities,  equity, 
and  budgetary  resources. 

^An  eighth  hearing  was  on  January  24,  2012,  the  date  of  the  panel’s  report. 

■^House  Armed  Services  Committee  Panel  on  Defense  Financial  Management  and 
Auditability  Reform,  Findings  and  Recommendations  (Washington,  D.C.:  Jan.  24,  2012). 
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recommendations,  1  was  addressed  to  the  House  Armed  Services 
Committee  and  29  were  addressed  to  DOD  in  the  following  four  areas 
reviewed  by  the  panel: 

•  Financial  Improvement  and  Audit  Readiness  (FIAR)  strategy  and 
methodology  (6  recommendations). 

•  Challenges  to  achieving  financial  management  reform  and  auditability 
(9  recommendations). 

•  Financial  management  workforce  (5  recommendations). 

•  Enterprise  resource  planning  (ERP)  system  implementation  efforts  (9 
recommendations).'^ 

You  asked  us  to  review  DOD’s  actions  to  implement  the  panel’s 
recommendations.  This  report  examines  the  extent  to  which  DOD  has 
implemented  the  29  panel  recommendations  addressed  to  it.  To  meet  this 
audit  objective,  we  analyzed  relevant  documentation  and  interviewed  key 
officials  from  the  Office  of  the  Under  Secretary  of  Defense  (Comptroller), 
including  its  Human  Capital  and  Resource  Management  and  FIAR 
Directorates,  and  the  Office  of  the  Deputy  Chief  Management  Officer 
(DCMO)  to  obtain  DOD’s  perspective  on  implementation  of  the 
recommendations.®  We  also  analyzed  supporting  documents  and 
interviewed  knowledgeable  officials  from  the  three  military  departments® 
and  two  service  providers — the  Defense  Finance  and  Accounting  Service 
(DFAS)  and  the  Defense  Logistics  Agency  (DLA).^  To  determine  DOD’s 


'^An  ERP  system  is  an  automated  system  using  commercial  off-the-shelf  software 
consisting  of  multiple,  integrated  functional  modules  that  perform  a  variety  of  business- 
related  tasks,  such  as  general  ledger  accounting,  payroll,  and  supply  chain  management. 

®The  FIAR  Directorate  provides  management  of  the  FIAR  Plan  to  ensure  integration  of 
DOD-wide  financial  improvement  efforts  through  various  activities,  including 
(1)  developing  and  issuing  the  FIAR  Guidance,  (2)  performing  monthly  detailed  reviews  of 
component  financial  improvement  plans  and  evaluating  related  deliverables,  and 
(3)  developing  metrics  for  monitoring  and  reporting  progress. 

®DOD  has  three  military  departments:  the  Department  of  the  Army,  Department  of  the 
Navy,  and  Department  of  the  Air  Force.  The  Department  of  the  Navy  includes  two  military 
services:  the  Navy  and  the  Marine  Corps. 

^DOD,  in  its  FIAR  Guidance,  has  defined  service  providers  as  “entities  that  provide 
services  to  and  are  responsible  for  executing  one  or  more  business  processes  on  behalf 
of  the  reporting  entities.” 
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methodology  and  plans  for  achieving  audit  readiness,  we  reviewed  DOD’s 
FIAR  Guidance®  and  semiannual  FIAR  Plan  Status  Reports.®  To 
determine  the  extent  to  which  DOD  had  implemented  the  panel 
recommendations,  we  also  considered  findings  disclosed  in  recent  DOD 
Inspector  General  (IG)  and  GAO  reports.  We  used  three  categories, 
consistent  with  those  developed  for  GAO’s  high-risk  work,''®  to  determine 
the  status  of  DOD’s  implementation  of  each  recommendation:  met, 
partially  met,  or  not  met.'’'' 

We  conducted  this  performance  audit  from  June  2014  to  September  2015 
in  accordance  with  generally  accepted  government  auditing  standards. 
Those  standards  require  that  we  plan  and  perform  the  audit  to  obtain 
sufficient,  appropriate  evidence  to  provide  a  reasonable  basis  for  our 
findings  and  conclusions  based  on  our  audit  objectives.  We  believe  that 
the  evidence  obtained  provides  a  reasonable  basis  for  our  findings  and 
conclusions  based  on  our  audit  objectives. 


®For  example,  the  most  recently  issued  FIAR  Guidance  was  dated  April  2015.  See 
Department  of  Defense,  Office  of  the  Under  Secretary  of  Defense  (Comptroller)/Chief 
Financial  Officer,  Financial  Improvement  and  Audit  Readiness  (FIAR)  Guidance 
(Washington,  D.C.:  April  2015). 

®For  example,  the  most  recently  issued  FIAR  Plan  Status  Report  was  dated  May  2015. 
See  Department  of  Defense,  Office  of  the  Under  Secretary  of  Defense  (Comptroller)/Chief 
Financial  Officer,  Financial  Improvement  and  Audit  Readiness  (FIAR)  Plan  Status  Report 
(Washington,  D.C.:  May  2015). 

^®GAO  maintains  an  ongoing  program  to  focus  on  government  operations  that  are  at  high 
risk  because  of  their  greater  vulnerabilities  to  fraud,  waste,  abuse,  and  mismanagement  or 
that  need  transformation  to  address  economy,  efficiency,  or  effectiveness  challenges.  See 
GAO,  Fligh-Risk  Series:  An  Update,  GAO-1 5-290  (Washington,  D.C.:  Feb.  11, 2015). 

^^“Met”  means  that  actions  have  been  taken  to  meet  the  recommendation  and  no 
significant  actions  need  to  be  taken  to  further  address  the  recommendation.  “Partially  met” 
means  that  some,  but  not  all  actions,  necessary  to  address  this  recommendation  have 
been  taken.  “Not  met”  means  that  few,  if  any  actions,  toward  addressing  the 
recommendation  have  been  taken. 
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Background 


DOD’s  Efforts  to  DOD’s  efforts  to  improve  its  financial  management  and  achieve  audit 

Strengthen  Internal  readiness  have  evolved  over  a  number  of  years  into  its  current  FIAR 

Control  Imorove  Financial  1995,  we  first  designated  DOD  financial  management  as  one  of 

.  .  ’  ^ H  A  h'  federal  government’s  programs  at  high  risk  of  waste,  fraud,  abuse,  or 

IVianagemeni,  ana  Acnieve  mismanagement  because  of  long-standing  and  pervasive  weaknesses  in 
Audit  Roadinoss  DOD’s  internal  control,  and  it  still  carries  that  designation  today.''^  Over 

the  past  two  decades,  DOD  has  initiated  efforts  to  strengthen  its  internal 
control,  become  auditable,  and  improve  its  financial  management. 
However,  as  we  stated  in  our  most  recent  high-risk  report,  DOD  has 
emphasized  asserting  audit  readiness  by  set  dates  over  assuring  that 
processes,  systems,  and  controls  are  effective,  reliable,  and 
sustainable.''^  DOD  submitted  its  biennial  strategic  plan  for  the 
improvement  of  financial  management  (Biennial  Plan)  to  Congress  on 
October  26,  1998,  as  required  by  section  1008  of  the  National  Defense 
Authorization  Act  (NDAA)  for  Fiscal  Year  1998.'’"'  This  Biennial  Plan  was 
an  important  first  step  toward  DOD  improving  its  financial  management 
operations.  The  Biennial  Plan  included,  for  the  first  time,  a  discussion  of 
the  importance  of  the  programmatic  functions  of  personnel,  acquisition, 
property  management,  and  inventory  management  to  the  department’s 
ability  to  support  consistent,  accurate  information  flows  to  all  information 
users.  Although  the  Biennial  Plan  included  a  number  of  initiatives  that 
would  help  improve  DOD’s  financial  management  plans,  we  reported  that 
it  lacked  critical  elements  necessary  for  producing  sustainable  financial 
management  improvement  over  the  long  term.''® 

Another  initiative  that  preceded  the  FIAR  effort  was  DOD’s  2003  Financial 
Improvement  Initiative,  which  was  intended  to  fundamentally  transform 
DOD’s  financial  management  operations  and  achieve  clean  financial 


^^GAO-l  5-290. 

^®GAO-1 5-290. 

^4pub.  L  No.  105-85,  §  1008,  111  Stat.  1629  (Nov.  18,  1997). 

^®GAO,  Financial  Management:  Analysis  of  DOD’s  First  Biennial  Financial  Management 
Improvement  Plan,  GAO/AIM D-99-44  (Washington,  D.C.:  Jan.  29,  1999). 
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statement  audit  opinions.''®  While  DOD’s  former  Comptroller  started  the 
2003  Financial  Improvement  Initiative  with  the  goal  of  obtaining  an 
unqualified  audit  opinion  for  fiscal  year  2007  on  DOD’s  department-wide 
financial  statements,  the  initiative  lacked  a  clearly  defined,  well- 
documented,  and  realistic  plan  to  make  the  goal  a  reality.  As  we 
previously  reported,  although  most  of  the  DOD  components,  including  the 
Army,  Navy,  and  Air  Force,  had  submitted  improvement  plans  to  the  DOD 
Comptroller,  DOD  had  not  yet  developed  an  integrated  departmental 
strategy,  key  milestones,  accountability  mechanisms,  or  departmental 
cost  estimates  for  achieving  its  fiscal  year  2007  audit  opinion  goal."'^ 

In  2005,  the  DOD  Comptroller  established  the  DOD  FIAR  Directorate  to 
develop,  manage,  and  implement  a  strategic  approach  for  addressing  the 
department’s  financial  management  weaknesses  and  achieving 
auditability  and  to  integrate  those  efforts  with  other  improvement 
activities,  such  as  the  department’s  business  system  modernization 
efforts.  DOD’s  first  FIAR  Plan  was  issued  in  2005  and  is  updated 
semiannually  through  the  FIAR  Plan  Status  Reports,  which  also 
summarize  the  current  status  of  DOD  and  its  components  in  executing 
the  FIAR  Plan. 

DOD’s  FIAR  strategy  and  approach  have  evolved  since  the  issuance  of 
the  first  FIAR  Plan  in  2005.  The  DOD  Comptroller  announced  in  August 
2009  that  in  DOD’s  effort  to  improve  its  financial  management 
information,  priority  would  be  given  to  improving  those  processes  and 
controls  that  produce  information  on  which  DOD  managers  rely  most 
heavily  to  run  the  agency.  Because  budgetary  information  is  widely  and 
regularly  used  for  management,  the  DOD  Comptroller  designated  as  one 
of  DOD’s  highest  priorities  the  improvement  of  its  budgetary  information 
and  processes  underlying  the  Statement  of  Budgetary  Resources 


^®For  the  purposes  of  this  report,  we  use  “clean  opinion”  to  refer  to  either  an  unmodified 
opinion  or  an  unqualified  opinion.  According  to  the  American  Institute  of  Certified  Public 
Accountants’  Forming  an  Opinion  and  Reporting  on  Financiai  Statements  (AU-C  Section 
700),  effective  for  audits  of  financial  statements  for  periods  ending  on  or  after  December 
15,  2012,  an  unmodified  opinion  states  that  the  financial  statements  are  presented  fairly, 
in  all  material  respects,  in  accordance  with  the  applicable  accounting  principles.  For 
periods  ending  before  December  15,  2012,  an  unmodified  opinion  was  known  as  an 
unqualified  opinion. 

^^GAO,  Financiai  Management:  Further  Actions  Are  Needed  to  Estabtish  Framework  to 
Guide  Audit  Opinion  and  Business  Management  improvement  Efforts  at  DOD, 
GAO-04-910R  (Washington,  D.C.:  Sept.  20,  2004). 
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(SBR).^®  The  United  States  Marine  Corps  was  selected  as  the  pilot 
military  service  for  an  audit  of  the  SBRJ®  The  Secretary  of  Defense 
underscored  the  department’s  SBR  priority  with  an  October  201 1 
memorandum  directing  the  Comptroller  to  provide  a  revised  plan  for 
achieving  audit  readiness  of  the  SBR  by  September  30,  2014,  with  the 
aim  to  provide  DOD  managers  with  auditable  General  Fund  information  to 
track  spending,  identify  waste,  and  improve  DOD’s  business  processes. 

In  response  to  component  difficulties  in  preparing  for  an  audit  of  the  SBR, 
the  November  2014  FIAR  Plan  Status  Report  and  the  November  2013 
revised  FIAR  Guidance  included  a  revision  to  narrow  the  scope  of  initial 
audits  to  only  current  year  budget  activity  and  expenditures  on  a  General 
Fund  Schedule  of  Budgetary  Activity. 


L6gislatiV6  R6quir6in6nts  The  NDAA  for  Fiscal  Year  2002  required  DOD  to  minimize  the  resources 
and  Time  Frames  spent  to  develop,  compile,  report,  and  audit  financial  statements  that  the 

Secretary  of  Defense  assesses  as  expected  to  be  unreliable. 
Additionally,  the  NDAA  for  Fiscal  Year  2008  designated  the  Deputy 
Secretary  of  Defense  as  the  department’s  Chief  Management  Officer 


1  ft 

The  financial  information  in  the  SBR  is  predominately  derived  from  a  federal  entity’s 
budget  accounts,  which  are  used  to  account  for  and  track  the  use  of  public  funds  in 
accordance  with  budgetary  accounting  rules.  The  SBR  provides  information,  at  a  specific 
point  in  time,  about  budgetary  resources  made  available  to  an  agency  as  well  as  the 
status  of  those  resources.  The  other  priority  was  mission-critical  asset  information. 

^®The  Marine  Corps  received  disclaimers  of  opinion  on  its  fiscal  year  2010  and  201 1 
Statement  of  Budgetary  Resources.  The  Marine  Corps  initially  received  a  clean  opinion  on 
its  fiscal  year  2012  Schedule  of  Budgetary  Activity;  however,  this  opinion  was  withdrawn  in 
March  2015. 

OA 

The  General  Fund  includes  appropriated  funding  for  personnel,  operation  and 
maintenance,  procurement,  research  and  development,  and  military  construction.  It  does 
not  include  the  Working  Capital  Fund,  which  is  funded  primarily  from  fees  charged  for 
goods  and  services  provided  to  customers. 

^^The  Schedule  of  Budgetary  Activity,  like  the  SBR,  is  designed  to  provide  information  on 
budgeted  spending  authority  as  outlined  in  the  President’s  Budget,  including  budgetary 
resources,  availability  of  budgetary  resources,  and  how  obligated  resources  have  been 
used.  Flowever,  unlike  the  SBR,  beginning  balances  and  prior  year  activities  will  be 
excluded  from  the  Schedule  of  Budgetary  Activity.  The  first-year  Schedule  of  Budgetary 
Activity  (fiscal  year  2015)  will  only  cover  activity  on  current  year  appropriations.  As 
described  in  the  FIAR  Guidance,  for  each  successive  fiscal  year  Schedule  of  Budgetary 
Activity,  the  audited  ending  balances  will  carry  forward  to  the  subsequent  year’s  beginning 
balance,  building  toward  the  SBR. 

22pub.  L  No.  107-107,  §  1008,  115  Stat.  1020,  1205-06  (Dec.  28,  2001). 
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(CMO),  created  a  DCMO  position,  and  designated  the  under  secretary  of 
each  military  department  as  the  CMO  for  the  respective  department. 

The  act  also  required  the  Secretary  of  Defense,  acting  through  the  CMO, 
to  develop  a  strategic  management  plan  that  among  other  things  would 
provide  a  detailed  description  of  performance  goals  and  measures  for 
improving  and  evaluating  the  overall  efficiency  and  effectiveness  of 
DOD’s  business  operations  and  actions  underway  to  improve  operations. 

To  establish  statutory  objectives  for  DOD  to  achieve  financial  statements 
that  are  validated  as  ready  for  audit  by  a  certain  date,  the  NDAA  for  Fiscal 
Year  2010  mandated  that  DOD  develop  and  maintain  a  FIAR  Plan  that 
includes,  among  other  things,  the  specific  actions  to  be  taken  and  costs 
associated  with  (1)  correcting  the  financial  management  deficiencies  that 
impair  the  department’s  ability  to  prepare  timely,  reliable,  and  complete 
financial  management  information  and  (2)  ensuring  that  DOD’s  financial 
statements  are  validated  as  ready  for  audit  by  not  later  than  September 
30,  201 7. In  addition,  the  2010  NDAA  required  that  DOD  (1)  provide 
semiannual  reports  by  no  later  than  May  15  and  November  15  on  the 
status  of  the  department’s  implementation  of  the  FIAR  Plan  (which  DOD 
provides  as  FIAR  Plan  Status  Reports)  to  congressional  defense 
committees,  (2)  develop  standardized  guidance  for  DOD  components’ 
financial  improvement  plans  (FIP),^®  and  (3)  define  oversight  roles  and 
assign  accountability  for  carrying  out  the  FIAR  Plan  to  appropriate 
officials  and  organizations. 

The  NDAA  for  Fiscal  Year  2013  amended  the  legal  requirement  to 
additionally  require  that  the  FIAR  Plan  Status  Reports  should  include 
(1 )  a  description  of  the  actions  military  departments  have  taken  to  achieve 
an  auditable  SBR  for  DOD  by  September  30,  2014,  and  (2)  a 
determination  by  each  military  department’s  CMO  on  whether  the  unit  is 
able  to  achieve  an  auditable  SBR  by  September  30,  2014,  without  an 
unaffordable  or  unsustainable  level  of  onetime  fixes  and  manual  work- 


23pub.  L.  No.  110-181,  §  904,  122  Stat.  3,  273  (Jan.  28,  2008). 

24pub.  L.  No.  111-84,  §  1003(a),  (b),  123  Stat.  2190,  2439-40  (Oct.  28,  2009). 

^®DOD’s  FIAR  Guidance,  first  issued  in  May  2010  and  updated  in  December  2011,  March 
2013,  November  2013,  and  April  2015,  is  DOD’s  standardized  guidance  providing  the 
methodology  for  the  components  to  follow  to  develop  and  implement  their  FIPs.  FIPs 
provide  a  framework  for  planning  and  tracking  the  steps  and  supporting  documentation 
necessary  to  achieve  auditability  within  the  FIAR  Methodology. 
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arounds  and  without  delaying  the  auditability  of  the  financial  statements.^® 
In  the  event  that  the  CMO  of  a  military  department  determines  that  the 
military  department  would  not  be  able  to  achieve  an  auditable  SBR  by 
that  date,  the  CMO  is  required  to  explain  why  the  military  department 
cannot  meet  that  date  and  provide  an  alternative  date  for  meeting  the 
target  date. 

In  the  November  2014  FIAR  Plan  Status  Report,  DOD  acknowledged  that 
it  did  not  meet  the  September  30,  2014,  target  date  for  achieving  audit 
readiness  of  the  SBR,  but  stated  that  the  three  military  departments 
asserted  Schedule  of  Budgetary  Activity  audit  readiness  in  the  last 
quarter  of  fiscal  year  2014.  In  January  2015,  independent  public 
accountant  (IPA)  firms  began  auditing  the  military  departments’  General 
Fund  Schedules  of  Budgetary  Activity  for  fiscal  year  2015.  For  the  first- 
year  Schedule  of  Budgetary  Activity  audits,  the  scope  is  the  schedules 
containing  only  current  year  appropriations  and  all  related  activity,  such 
as  obligations  and  outlays,  against  those  appropriated  funds  approved  on 
or  after  October  1 , 2014.  As  a  result,  these  first-year  Schedule  of 
Budgetary  Activity  audits  exclude  unexpended  amounts,  whether 
obligated  or  unobligated,  carried  over  from  prior  years’  funding  as  well  as 
information  on  the  status  and  use  of  such  funding  in  subsequent  years 
(e.g.,  obligations  incurred  and  outlays). These  amounts  will  remain 
unaudited.  Over  the  ensuing  years,  as  the  unaudited  portion  of  SBR 
balances  and  activity  related  to  this  funding  decline,  the  audited  portion  is 
expected  to  increase. 

The  NDAA  for  Fiscal  Year  2014  mandates  that  upon  the  conclusion  of 
fiscal  year  2018,  the  Secretary  of  Defense  shall  ensure  that  a  full  audit  is 
performed  on  DOD’s  fiscal  year  2018  financial  statements  and  submit  the 
results  of  that  audit  to  Congress  not  later  than  March  31 , 201 9.^® 


2®Pub.  L  No.  112-239,  §  1005(a),  126  Stat.  1632,  1904  (Jan.  2,  2013). 

^^Unobligated  amounts  are  the  cumulative  portion  of  an  entity’s  obligation  authority  that 
has  not  yet  been  obligated.  An  agency  incurs  an  obligation,  for  example,  when  it  places  an 
order,  signs  a  contract,  awards  a  grant,  purchases  a  service,  or  takes  other  actions  that 
require  the  government  to  make  payments  to  the  public  or  from  one  government  account 
to  another.  Obligations  are  usually  liquidated  by  payments  (outlays).  Unexpended 
amounts  represent  unobligated  funds  or  obligated  amounts  that  have  not  yet  been 
liquidated. 

2®Pub.  L.  No.  113-66,  §  1003,  127  Stat.  671,  842  (Dec.  26,  2013),  codified  at  :0  U.S.C.  § 
2222  note. 
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FIAR  Plan  DOD’s  FIAR  Plan  is  DOD’s  strategic  plan  and  management  tool  for 

guiding,  monitoring,  and  reporting  on  the  department’s  financial 
management  improvement  efforts.  As  such,  the  plan  communicates 
incremental  progress  in  addressing  the  department’s  financial 
management  weaknesses  and  achieving  financial  statement  auditability. 
The  plan  focuses  on  several  goals: 

1 .  achieve  and  sustain  unqualified  assurance  on  the  effectiveness  of 
internal  controls  through  the  implementation  of  sustained 
improvements  in  business  processes  and  controls  addressing  the 
material  weaknesses  in  internal  control,^® 

2.  develop  and  implement  financial  management  systems  that  support 
effective  financial  management,  and 

3.  achieve  and  sustain  financial  statement  audit  readiness. 

The  department  has  envisioned  achieving  financial  statement  auditability 
in  four  waves  of  concerted  improvement  activities  described  in  its  FIAR 
Plan.  The  activities  of  these  four  waves  are  within  groups  of  end-to-end 
business  processes,  which  are  further  broken  down  into  discrete  units, 
called  assessable  units.  DOD  defines  an  assessable  unit  as  any  part  of 
the  financial  statements,  such  as  a  line  item  or  a  class  of  assets,  a  class 
of  transactions,  or  a  process  or  a  system,  that  helps  produce  the  financial 
statements.  The  four  waves  are  as  follows: 

•  Wave  1 :  Appropriations  Received  Audit 

•  Wave  2:  Schedule  of  Budgetary  Activity/SBR  Audit 

•  Wave  3:  Mission  Critical  Asset  Existence  and  Completeness  Audit 

•  Wave  4:  Full  Financial  Statements  Audit 

Waves  1  through  3  started  concurrently,  and  an  IPAfirm  validated  Wave 
1  as  audit  ready  in  August  2011.  In  the  November  2013  FIAR  Plan  Status 
report,  DOD  defined  the  term  audit  ready  as  meaning  that  the  department 


90 

A  material  weakness  is  a  deficiency,  or  combination  of  deficiencies,  in  internal  control 
over  financial  reporting,  such  that  there  is  a  reasonable  possibility  that  a  material 
misstatement  of  the  entity’s  financial  statements  will  not  be  prevented,  or  detected  and 
corrected,  on  a  timely  basis.  A  deficiency  in  internal  control  exists  when  the  design  or 
operation  of  a  control  does  not  allow  management  or  employees,  in  the  normal  course  of 
performing  their  assigned  functions,  to  prevent,  or  detect  and  correct,  misstatements  on  a 
timely  basis. 
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has  strengthened  internal  controls  and  improved  financial  practices, 
processes,  and  systems  so  that  there  is  reasonable  confidence  that  the 
information  can  withstand  an  audit  by  an  independent  auditor.  The 
department  organized  these  audit  readiness  waves  to  use  the 
interdependencies  between  budgetary  and  accounting  information.  FIAR 
priorities  have  required  reporting  entities  to  devote  their  resources  and 
efforts  toward  completing  audit  readiness  activities  for  Waves  1  through  3 
before  beginning  work  for  Wave  4.^°  DOD  officials  have  stated  that  much 
of  the  audit  readiness  work  required  to  complete  Waves  1  through  3 
affects  Wave  4  requirements  and  objectives.  For  example,  DOD  has 
identified  interdependencies  between  accounts  included  in  Waves  2 
(budgetary)  and  4  (accounting  information).  DOD  officials  stated  that  the 
department  has  expanded  its  audit  readiness  priorities  from  budgetary 
data  reported  on  the  SBR  to  all  financial  transactions  reported  on  the 
Balance  Sheet  and  the  Statements  of  Net  Cost  and  Changes  in  Net 
Position.^''  As  stated  in  the  May  2015  FIAR  Plan  Status  Report,  the  focus 
of  current  FIAR  activity  includes  (1)  valuing  and  accurately  reporting  over 
$2.2  trillion  in  assets,  (2)  reporting  over  $2.4  trillion  in  liabilities,  and 
(3)  preparing  full  financial  statements  for  audit. 


FIAR  Guidance  The  FIAR  Guidance,  first  issued  in  May  2010  and  periodically  updated, 

provides  the  standard  methodology  by  which  the  components  are  to 
implement  the  FIAR  Plan.  DOD  components  are  required  to  establish 
assessable  units  for  all  processes,  systems,  or  classes  of  assets  that 
result  in  material  transactions  and  balances  in  their  financial  statements 
to  focus  their  improvement  efforts.  Components  are  required  to  prepare 
FIPs  for  each  assessable  unit  under  the  FIAR  Guidance.  According  to  the 
FIAR  Guidance,  component  audit  readiness  assertions  for  assessable 
units  are  to  specify  that  (1)  control  activities  are  suitably  designed  and 
implemented,  operating  effectively,  and  sufficiently  documented  to 
provide  reasonable  assurance  that  applicable  financial  reporting 
objectives  are  achieved;  (2)  key  supporting  documents  are  readily 


OA 

Under  the  FIAR  Guidance,  DOD  components  include  reporting  entities  (i.e.,  DOD 
entities  or  funds  that  prepare  stand-alone  financial  statements  included  in  the  DOD-wide 
financial  statements)  and  service  providers  that  provide  a  variety  of  accounting,  personnel, 
logistics,  systems,  or  other  support  services. 

O'! 

Department  of  Defense,  Office  of  the  Under  Secretary  of  Defense  (Comptroller)/Chief 
Financial  Officer,  Financial  Improvement  and  Audit  Readiness  (FIAR)  Plan  Status  Report 
(Washington,  D.C.:  May  2015). 
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available  for  review;  and  (3)  account  balances  and  transactions  are 
accurately  recorded.  DOD  has  established  a  mandatory  set  of  five 
standardized  phases  for  achieving  audit  readiness  that  its  components 
are  required  to  apply  to  each  assessable  unit.  As  of  the  April  2015  FIAR 
Guidance,  these  five  phases  were  Discovery,  Corrective  Action, 
Assertion/Examination,  Validation,  and  Audit. 

In  the  FIAR  Guidance,  service  providers,  such  as  DFAS  and  DLA,  are 
defined  as  components  that  are  responsible  for  their  systems  and  data, 
processes  and  internal  controls,  and  supporting  documentation  that  affect 
a  reporting  entity’s  audit  readiness.  Service  providers  are  to  prepare 
documentation  illustrating  the  financial  reporting  aspects  of  their 
operations  through  end-to-end  business  processes.  Based  on  that 
documentation,  the  service  providers  are  to  identify  and  evaluate  control 
activities  and  supporting  documentation  over  those  processes  that  affect 
the  reporting  entities’  financial  reporting  objectives  (i.e.,  the  outcomes 
needed  to  achieve  proper  financial  reporting  and  serve  as  a  point  against 
which  the  effectiveness  of  internal  controls  over  financial  reporting  can  be 
evaluated).  In  accordance  with  the  FIAR  Guidance,  service  providers’ 
control  activities  and  supporting  documentation  undergo  examinations 
conducted  in  accordance  with  the  Statement  on  Standards  for  Attestation 
Engagements  (SSAE)  No.  16,  Reporting  on  Controls  at  a  Service 
Organization.^^  Service  providers,  such  as  DFAS,  with  three  or  more 
customers  working  to  become  audit  ready  must  obtain  SSAE  No.  16 
examinations  on  their  internal  controls  over  financial  reporting.  According 
to  DOD  officials,  the  results  of  these  examinations  can  then  be  relied 
upon  by  all  of  the  customers,  reducing  audit  time  and  therefore  saving 
money. 

The  updated  FIAR  Guidance,  issued  in  April  2015,  provides  specific 
tasks,  work  products,  and  deliverables  for  achieving  and  validating  full 
financial  statement  auditability.  As  described  in  this  FIAR  Guidance,  DOD 
has  expanded  its  FIAR  priorities  from  budgetary  information  and  mission- 


accordance  with  SSAE  No.  16,  Reporting  on  Controls  at  a  Service  Organization,  the 
auditors  of  each  of  these  external  service  organizations  issue  reports  concerning  the 
design  and  operating  effectiveness  of  the  service  organizations’  internal  control  over  the 
processing  of  user  transactions.  Services  provided  by  an  external  service  organization  are 
considered  part  of  a  user  entity’s  information  system  relevant  to  the  user  entity’s  financial 
reporting  if  the  services  affect  classes  of  transactions  that  are  significant  to  the  user 
entity’s  financial  statements  as  well  as  the  financial  reporting  process  used  to  prepare  the 
financial  statements. 
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critical  asset  information  to  include  two  other  priorities — proprietary 
accounting  data/information  for  the  Balance  Sheet  and  Statements  of  Net 
Cost  and  Changes  in  Net  Position  and  valuation  of  assets  and  liabilities.^^ 
It  also  includes  newly  established  milestones  that  the  components  must 
meet  to  give  DOD  the  best  opportunity  to  succeed  in  achieving  auditable 
financial  statements  by  fiscal-year  end  2017. 


Th©  Pansl  Rsport  The  panel  reviewed  the  following  four  areas  and  provided  a  total  of  29 

recommendations  to  DOD  to  resolve  the  issues  it  found  in  each  area. 

•  FIAR  strategy  and  methodology  (6  recommendations).  While 
acknowledging  that  the  department  had  a  reasonable  strategy  and 
methodology  for  its  FIAR  effort,  the  panel  stated  that  DOD’s  strategy 
needed  to  be  more  detailed  and  refined.  For  example,  according  to 
the  panel,  DOD  had  not  yet  fully  defined  all  of  the  elements  of  the 
strategy  necessary  to  achieve  audit  readiness  on  all  financial 
statements  in  2017.  Moreover,  the  panel  was  concerned  that  certain 
DOD  components  may  not  be  effectively  implementing  the  FIAR 
strategy  and  methodology. 

•  Challenges  to  achieving  financial  management  reform  and  auditability 
(9  recommendations).  The  panel  recognized  that  DOD’s  size  and 
complexity  contribute  to  the  complicated  and  pervasive  challenges  to 
its  financial  management  processes  and  related  business  operations 
and  systems.  In  its  report,  the  panel  expressed  concern  about  DOD’s 
progress  in  addressing  long-standing  weaknesses  in  internal  controls. 
Specifically,  the  panel  referred  to  the  numerous  material  weaknesses 
in  internal  control  over  financial  reporting — cited  by  the  DOD  IG  in  its 
reports  since  the  mid-1990s — that  have  affected  DOD’s  ability  to 
achieve  a  clean  audit  opinion.  In  addition,  the  panel  noted  that 
weaknesses  in  controls  over  the  recording,  accounting,  and  reporting 
of  financial  information  jeopardize  DOD’s  ability  to  safeguard  taxpayer 
dollars.  For  example,  these  weaknesses  can  result  in  improper 


oo 

Proprietary  accounts  provide  the  information  for  the  financial  statements  based  on 
Federal  Accounting  Standards  Advisory  Board  standards  and  are  intended  to  produce  an 
economic,  rather  than  budgetary,  measure  of  operations  and  resources. 


Page  12 


GAO-15-463  HASC  Panel  Recommendations 


payments, Antideficiency  Act  (ADA)  violations,^®  and  problem 
disbursements.®®  The  panel  also  noted  organizational  challenges 
faced  by  the  logistics  community,  military  components,  and  DFAS. 
Specifically,  the  majority  of  transactions  recorded  in  accounting 
systems  are  initiated  by  military  components,  including  military 
commands,  installations,  and  bases,  and  within  nonfinancial  functional 
communities,  such  as  acquisition  and  logistics.  The  panel  stated  that 
continued  emphasis  must  be  placed  on  fully  engaging  both  the 
military  components  and  functional  communities  in  audit  readiness 
efforts. 

•  Financial  management  workforce  (5  recommendations).  According  to 
the  panel,  ensuring  that  the  financial  management  workforce  is 
adequately  staffed,  skilled,  and  well-trained  is  crucial  to  DOD’s  ability 
to  improve  financial  management.  For  example,  the  panel  was 
concerned  that  DOD  had  not  yet  performed  a  complete  department¬ 
wide  systematic  competency  assessment,  which  would  include 
analysis  of  the  types  and  ranges  of  abilities,  knowledge  bases,  and 
skills  of  the  present  financial  management  workforce  and  those  that 
will  be  needed  in  the  future. 

•  ERP  system  implementation  efforts  (9  recommendations).  While 
acknowledging  that  DOD  has  taken  positive  steps,  the  panel 


®^Underthe  Improper  Payments  Information  Act  of  2002,  as  amended,  an  improper 
payment  is  statutorily  defined  as  any  payment  that  should  not  have  been  made  or  that 
was  made  in  an  incorrect  amount  (including  overpayments  and  underpayments)  under 
statutory,  contractual,  administrative,  or  other  legally  applicable  requirements.  It  includes 
any  payment  to  an  ineligible  recipient,  any  payment  for  an  ineligible  good  or  service,  any 
duplicate  payment,  any  payment  for  a  good  or  service  not  received  (except  for  such 
payments  where  authorized  by  law),  and  any  payment  that  does  not  account  for  credit  for 
applicable  discounts.  Pub.  L.  No.  107-300,  116  Stat.  2350  (Nov.  26,  2002)  codified  as 
amended  at  3^  U.S.C.  §  3321  note. 

®®31  U.S.C.  §§  1341-42,  1349-52,  1511-19.  The  ADA,  among  other  things,  prohibits 
agencies  from  incurring  obligations  or  making  expenditures  in  excess  of  or  in  advance  of 
an  appropriation  or  in  excess  of  an  apportionment. 

®®Problem  disbursements  include  both  unmatched  disbursements  and  negative 
unliquidated  obligations.  Unmatched  disbursements  are  disbursements  that  have  been 
paid  by  an  accounting  office  but  have  not  been  matched  to  the  correct  obligation  records. 
A  negative  unliquidated  obligation  is  a  disbursement  transaction  that  has  been  matched  to 
an  obligation,  but  the  total  recorded  disbursement  exceeds  the  recorded  obligation.  In  its 
report,  the  panel  stated  that  problem  disbursements  impede  DOD’s  performance  of  proper 
Fund  Balance  with  Treasury  reconciliations,  which  affects  DOD’s  ability  to  report  reliable 
information  on  its  financial  statements. 
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expressed  five  concerns  about  the  department’s  ERP  system 
implementation  efforts,  including  (1)  reported  schedule  delays  and 
cost  overruns  as  well  as  the  reliability  of  ERP  schedule  and  cost 
estimates;  (2)  issues  with  the  requirements  process  in  that  in  some 
cases  not  enough  requirements  are  identified  and  in  some  cases  too 
many  requirements  are  included  in  ERP  systems;^^  (3)  ERP  systems 
that  may  not  provide  the  capabilities  needed  for  achieving  FIAR 
objectives;  (4)  poor  execution  of  data  conversion  that  could  cause 
delays  in  the  full  implementation  of  the  ERP  systems;^®  and  (5)  the 
numerous  interfaces  that  exist  between  the  legacy  systems  and  the 
ERP  systems  and  the  problems  associated  with  these  interfaces  that 
could  compromise  ERP  functionality.  In  its  report,  the  panel  also 
recognized  that  because  most  financial  information  is  maintained  in 
computer  systems,  the  reliability  of  the  financial  data  in  these  systems 
depends  on  the  effectiveness  of  information  system  controls  over  how 
those  systems  operate. 


DOD  Has  Taken 
Actions  to  Implement 
the  Panel’s 
Recommendations, 
but  Significant 
Challenges  Remain 
to  Achieve  Auditability 


We  determined  that  DOD’s  actions  have  met  6  of  the  panel’s 
recommendations  and  partially  met  23.  In  its  May  2015  FIAR  Plan  Status 
Report,  DOD  stated  that  9  recommendations  were  met  and  the  remaining 
20  were  partially  met.  With  regard  to  the  9  recommendations  that  DOD 
reported  as  met,  we  determined  three  to  be  partially  met.  Table  1  includes 
a  list  of  the  29  panel  recommendations,  shown  by  the  four  areas  reviewed 
by  the  panel,  and  our  determination  on  the  status  of  DOD’s 
implementation  of  each  recommendation  along  with  the  status  DOD 
reported  in  May  2015.  See  appendix  I  for  detailed  information  on  each  of 
the  29  recommendations.  While  DOD  is  making  progress,  it  is  important 
to  note  that  implementation  of  the  panel’s  recommendations  may  not 
include  all  of  the  actions  that  the  department  must  take  to  achieve 
auditable  financial  statements.  For  example,  as  the  DOD  IG  and  the  IPA 


^^Requirements  establish  what  the  system  is  to  do,  how  well  it  is  to  do  it,  and  how  it  is  to 
interact  with  other  systems.  Appropriate  requirements  development  involves  eliciting  and 
developing  customer  and  stakeholder  requirements  and  analyzing  them  to  ensure  that 
they  will  meet  users’  needs  and  expectations.  It  also  consists  of  validating  requirements 
as  the  system  is  being  developed  to  ensure  that  the  final  system  to  be  deployed  will 
perform  as  intended  in  an  operational  environment.  The  inclusion  of  too  many 
requirements  can  make  ERPs  more  complicated  than  needed;  too  few  requirements  may 
result  in  ERPs  that  do  not  provide  the  needed  functionality. 

^®Data  conversion  is  the  modification  of  existing  data  to  enable  it  to  operate  with  similar 
functional  capability  in  a  different  environment. 
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firms  perform  examinations  and  audits,  they  may  identify  deficiencies  in 
internal  controls  that  were  not  previously  known  and  therefore  were  not 
addressed  by  the  panel’s  recommendations.^® 


Table  1 :  Status  of  DOD  Implementation  of  Recommendations  Made  by  the  Panel  on  Defense  Financial  Management  and 
Auditability  Reform  (as  of  May  2015) 

No. 

Panel  recommendation 

Status  per  GAO 

Status  per  DOD 

Financial  Improvement  and  Audit  Readiness  (FIAR)  strategy  and  methodology 

1.1 

The  Department’s  FIAR  Strategy  for  Wave  4  (Full  Audit  Except  for  Legacy  Asset 
Valuation)  should  include  a  complete  analysis  of  interdependencies  among  Waves  1- 
3  and  Wave  4. 

Partially  met 

Partially  met 

1.2 

The  Department  should  establish  a  DOD  Financial  Reporting  element,  or  wave,  that 
includes  a  process  for  consolidating  the  components’  financial  information  into  the 
DOD’s  agency-wide  financial  statements.  The  Department  should  report  this 
element’s  audit  readiness  progress  in  the  FIAR  Plan  Status  Report. 

Partially  met 

Partially  met 

1.3 

The  DOD  should  re-evaluate  its  position  on  accepting  historical  asset  costs  when  the 
Department  nears  auditability  on  its  financial  statements  in  light  of  certain  allowances 
in  federal  accounting  standards.  The  findings  of  a  re-evaluation  may  support  the 
development  of  an  audit  readiness  strategy  for  valuing  legacy  asset  balances. 

Partially  met 

Partially  met 

1.4 

The  Department  should:  (1)  analyze  the  causes  of  FIAR  Plan  implementation 
difficulties;  (2)  develop  and  implement  corrective  action  plans  to  address  identified 
weaknesses  or  deficiencies;  and  (3)  develop  a  communications  plan  to  circulate  any 
resulting  lessons-learned  throughout  the  Department. 

Partially  met 

Partially  met 

1.5 

The  Under  Secretary  of  Defense  (Comptroller)  (USD(C)),  in  consultation  with  the 
Deputy  Chief  Management  Officer  (DCMO)  of  the  Department  of  Defense,  the 
secretaries  of  the  military  departments,  and  the  heads  of  the  defense  agencies  and 
field  activities  should  incorporate  risk  mitigation  plans  to  support  the  meeting  of  future 
interim  milestones  in  the  FIAR  Plan. 

Partially  met 

Partially  met 

1.6 

The  FIAR  Governance  Board  should  attest  as  to  whether  the  DOD  is  on  track  to 
achieve  audit  readiness  in  2017  in  each  FIAR  Plan  Status  Report. 

Partially  met 

Met 

Challenges  to  achieving  financial  management  reform  and  auditability 

2.1 

The  Department  should  include  objective  and  measurable  criteria  regarding  FIAR- 
related  goals  in  its  senior  personnel  performance  plans  and  evaluations.  Performance 
evaluated  on  the  basis  of  such  criteria  should  be  appropriately  rewarded  or  held 
accountable.  Evaluated  performances  should  be  documented  and  tracked  to 
measure  progress  over  time. 

Partially  met 

Met 

oq 

Examinations  of  audit  readiness  are  done  by  either  the  DOD  IG  or  an  IPA  firm. 
Examinations  are  different  from  financial  statement  audits.  According  to  DOD,  auditors 
complete  an  examination  to  validate  management’s  assertion  that  the  business  or 
financial  process  is  audit  ready. 
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No. 

Panel  recommendation 

Status  per  GAO 

Status  per  DOD 

2.2 

To  improve  oversight  of  the  FIAR  effort,  the  Department  should  require  each  DOD 
component  senior  executive  committee  to  review  its  corresponding  component’s 
audit  readiness  assertion  packages  for  compliance  with  FIAR  Guidance  prior  to 
submission  of  those  packages  to  the  Office  of  the  USD(C)  for  validation. 

Partially  met 

Met 

2.3 

The  Department  should  develop  comprehensive  corrective  action  plans  to  address 
existing  material  weaknesses  and  those  identified  during  the  FIAR  effort. 

Partially  met 

Partially  met 

2.4 

To  reduce  improper  payments,  the  Department  should  re-evaluate  its  methodology 
for  identifying  and  reporting  improper  payments. 

Partially  met 

Partially  met 

2.5 

To  reduce  Antideficiency  Act  (ADA)  violations,  the  Department  should  (1)  perform  an 
analysis  of  the  causes  for  its  ADA  violations  and  then  develop  and  implement 
procedures  to  address  identified  causes  and  (2)  ensure  that  key  funds  control 
personnel  are  adequately  trained  to  prevent,  detect,  and  report  ADA  violations. 

Met 

Met 

2.6 

To  reduce  problem  disbursements,  the  Department  should  address  the  underlying 
causes  of  problem  disbursements  in  its  efforts  to  develop  and  implement  enterprise 
resource  planning  (ERP)  systems. 

Partially  met 

Partially  met 

2.7 

The  Department  should  identify  and  institutionalize  best  practices,  as  applicable, 
throughout  the  DOD  to  reinforce  the  full  engagement  of  those  functional  communities 
outside  of  the  financial  management  community  in  audit  readiness  efforts. 

Partially  met 

Partially  met 

2.8 

The  Department  should  develop  a  forum  in  which  the  military  commands  can  share 
lessons  learned  from  their  respective  audit  efforts. 

Met 

Met 

2.9 

The  DOD  Comptroller  should  include  milestones  along  with  the  status  of  DOD 
financial  service  provider  efforts  to  achieve  effective  controls  over  the  major 
processes  that  affect  DOD  customers  in  the  FIAR  Plan  Status  Reports.  These 
milestones  should  be  consistent  with  the  customer  organizations’  audit  readiness 
milestones. 

Partially  met 

Partially  met 

Financial  management  workforce 

3.1 

The  Department  should  assess  its  financial  management  workforce  and  that  of  all 
other  functional  areas  performing  financial  management-related  functions  regarding: 

(1 )  critical  skills  and  competencies  of  the  existing  civilian  employee  workforce; 

(2)  critical  skills  and  competencies  that  may  be  needed  over  the  next  decade; 

(3)  gaps  between  current  requirements  and  existing  workforce  competencies;  and 

(4)  gaps  between  projected  requirements  and  existing  workforce  competencies.  The 
assessment  should  include  federal  civilian,  military,  and  contracted  personnel 
performing  financial  management-related  functions. 

Partially  met 

Partially  met 

3.2 

The  Department  should  utilize  the  expertise  of  certified  public  accountants  (CPAs) 
with  financial  statement  audit  experience  in  its  audit  readiness  efforts  as  conducted 
by  the  federal  civilian  workforce  or  contracted  personnel,  as  appropriate. 

Met 

Met 

3.3 

The  Department  should  develop  and  implement  effective  financial  training  programs 
for  personnel  serving  in  functional  communities  outside  of  the  financial  management 
community. 

Met 

Met 

3.4 

The  Department  should  develop  and  implement  effective  ERP  training  programs  for 
personnel  within  and  outside  of  the  financial  management  community  who  utilize,  or 
will  be  expected  to  utilize,  an  ERP  system  in  their  day-to-day  operations.  In 
developing  these  training  programs,  the  Department  should  implement  lessons 
learned  from  previous  training  provided  to  ERP  users. 

Met 

Met 
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No. 

Panel  recommendation 

Status  per  GAO 

Status  per  DOD 

3.5 

The  Department  should  develop  its  proposal  for  an  exchange  program  between  the 
DOD  and  the  private  sector.  In  doing  so,  the  Department  should  develop  specific 
criteria,  regarding  the  personnel  to  be  exchanged  and  the  organizations  that  would 
participate.  The  Department  should  then  submit  its  proposal  to  the  congressional 
committees  of  jurisdiction  for  consideration. 

Met 

Met 

ERP  system  implementation  efforts 

4.1 

The  Department  should  include  additional  details  on  ERP  programs  in  the  FIAR  Plan 
Status  Reports,  including  full  deployment  dates,  when  known,  and  key  milestone 
dates.  These  status  reports  should  describe  the  risks  and  potential  consequences  of: 

(1 )  failing  to  satisfy  outstanding  ERP  functionality  requirements;  or  (2)  incurring  future 
ERP  milestone  delays.  The  status  reports  should  describe  the  mitigation  measures 
taken  by  the  Department  to  reduce  these  risks.  The  status  reports  should  also  explain 
any  actual  schedule  slippages  or  cost  increases  and  the  actions  taken  by  the  DOD  to 
remedy  any  such  development. 

Partially  met 

Partially  met 

4.2 

The  ERP  program  offices  should  integrate  FIAR  milestones  into  their  program 
schedules.  ERP  program  managers  should  be  evaluated  on  their  ability  to  maintain 
FIAR  milestones  as  well  as  program  acquisition-related  milestones. 

Partially  met 

Partially  met 

4.3 

The  Department  should  develop  ERP-related  schedule  and  cost  estimates  based  on 
best  practices  for  future  ERP  deployments. 

Partially  met 

Partially  met 

4.4 

The  Department  should  evaluate  changes  to  ERP  requirements  as  those  systems  are 
developed,  implemented,  and  utilized. 

Partially  met 

Partially  met 

4.5 

The  Department  should  evaluate  its  requirement  process  for  ERP  systems.  The 
Department  should  assess  the  decision-making  process,  regarding  ERP 
requirements,  at  every  level  of  authority.  The  Department  should  then  determine 
what,  if  any,  changes  may  be  needed. 

Partially  met 

Partially  met 

4.6 

The  Department  should  establish  risk  mitigation  plans  to  address  actual  and  potential 
weaknesses  or  deficiencies  associated  with  the  development,  implementation,  or 
utilization  of  its  ERP  systems  that  could  affect  the  achievement  of  FIAR  goals.  At  a 
minimum,  each  risk  mitigation  plan  should:  (1)  identify  measures  for  resolving  any 
such  weaknesses  or  deficiencies;  (2)  assign  responsibilities  within  the  Department  to 
implement  such  measures;  (3)  specify  implementation  steps  for  such  measures; 

(4)  provide  timeframes  for  implementing  such  measures;  and  (5)  identify  any 
alternative  arrangements  outside  of  the  ERP  environment  that  may  be  necessary  for 
meeting  FIAR  objectives. 

Partially  met 

Partially  met 

4.7 

The  Department  should  evaluate  lessons  learned  from  previous  data  conversion 
efforts,  and  it  should  incorporate  these  lessons  into  its  ERP  data  conversion  plans. 

The  Department  should  update  its  ERP  data  conversion  plans  periodically.  Updates 
should  include  assessments  of:  the  progress  made  in  converting  data  into  the  ERP 
environment;  whether  that  progress  supports  the  satisfaction  of  existing 
requirements;  and  whether  additional  data  conversion  requirements  would  facilitate 
the  achievement  of  FIAR  objectives.  The  Department  should  also  assess  the  merits 
of  designating  a  senior  official  (such  as  the  Chief  Management  Officer  (CMO)  or  the 
DCMO)  to  be  responsible  for  the  coordination  and  managerial  oversight  of  data 
conversion. 

Partially  met 

Partially  met 

4.8 

The  Department  should:  (1)  evaluate  the  causes  of  system  interface  problems; 

(2)  determine  whether  the  number  of  interfaces  can  be  reduced  (e.g.,  by 
incorporating  activities  performed  by  legacy  systems  into  the  ERPs);  and 

(3)  determine  what  improvements  can  be  made  to  support  more  effective  interfaces 
between  systems. 

Partially  met 

Partially  met 
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No.  Panel  recommendation 

Status  per  GAO 

Status  per  DOD 

4.9  The  DOD  DCMO,  in  coordination  with  the  Director,  Operational  Test  and  Evaluation 

Partially  met 

Partially  met 

and  the  Deputy  Assistant  Secretary  of  Defense  for  Development  Test  and  Evaluation, 
should  assess  information  system  control  testing  needs  for  all  ERPs  being  developed 
by  the  DOD  and  determine  whether  appropriate  workforce  levels  and  corresponding 
skill  sets  exist  within  the  Department’s  developmental  and  operational  test 
communities.  The  Department  should  take  actions  to  address  any  identified 
shortfalls. 


Sources:  House  Armed  Services  Committee  Panei  on  Defense  Financiai  Management  and  Auditability  Reform,  Findings  and  Recommendations  (Washington,  D.C.:  Jan.  24,  2012);  Department  of  Defense 
(FIAR  Pian  Status  Report,  May  2015);  and  GAO  (analysis).  |  GAO-15-463 


DOD’s  Actions  Have  Met 
Six  of  the  Panel’s 
Recommendations 


We  agree  with  DOD’s  status  determinations  that  its  actions  have  met  six 
of  the  panel’s  recommendations  (see  table  1,  recommendations  2.5,  2.8, 
3.2,  3.3,  3.4,  and  3.5).  Two  of  these  relate  to  the  area  on  challenges  to 
achieving  financial  management  reform  and  auditability.  DOD  has  taken 
the  actions  recommended  by  the  panel  to  reduce  ADA  violations  by 
analyzing  the  causes  of  these  violations;  developing  and  implementing 
procedures  to  address  them;  and  ensuring  that  key  funds  control 
personnel  are  adequately  trained  to  prevent,  detect,  and  report  ADA 
violations  (2.5).  In  addition,  as  recommended  by  the  panel,  DOD  has 
developed  forums  for  sharing  lessons  learned  within  commands  of 
military  departments  as  well  as  external  to  these  departments  (2.8). 

These  information-sharing  forums  include  newsletters,  quarterly  in- 
process  reviews,  and  stakeholder  meetings  as  well  as  the  FIAR 
Governance  Board,  FIAR  Committee,  and  FIAR  Subcommittee.  DOD  has 
also  met  the  requirements  of  four  financial  management  workforce- 
related  recommendations.  Actions  taken  include  using  the  expertise  of 
certified  public  accountants  with  financial  statement  audit  experience  in  its 
audit  readiness  efforts  (3.2);  developing  and  making  financial 
management  web-based  courses  available  to  both  personnel  in  the 
financial  management  functional  community  and  those  outside  of  the 
financial  management  community,  such  as  personnel  in  the  logistics  and 
acquisition  functional  communities  (3.3);  providing  training  programs  for 
the  department’s  current  ERP  systems  that  users  are  to  complete  prior  to 
obtaining  access  to  these  systems  (3.4);  and  submitting  a  proposal  to 
both  the  Senate  and  House  Armed  Services  Committees  for  a  financial 
management  exchange  program  between  DOD  and  the  private  sector 
(3.5).  Further  details  on  the  specific  recommendations  made  and  DOD’s 
actions  taken  are  discussed  in  appendix  I. 
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DOD’s  Actions  Have 
Partially  Met  Three 
Recommendations  That 
DOD  Classified  as  Met 


We  determined  that  DOD’s  actions  partially  met  three  of  the  panel’s 
recommendations  for  which  DOD  had  reported  the  status  as  met  (see 
table  1,  recommendations  1.6,  2.1,  and  2.2).  Descriptions  of  the  panel’s 
recommendations,  the  department’s  actions,  our  reasons  for  disagreeing 
with  DOD  on  the  status  of  these  recommendations,  and  the  additional 
actions  needed  to  fully  address  the  panel  recommendations  are 
discussed  below. 


•  The  panel  recommended  that  the  FIAR  Governance  Board  attest  to 
whether  DOD  is  on  track  to  achieve  audit  readiness  in  2017  in  each 
FIAR  Plan  Status  Report  (1.6)."^°  DOD  reported  this  recommendation 
as  met  because  each  FIAR  Plan  Status  Report  is  coordinated  among 
FIAR  Governance  Board  members,  providing  them  with  the 
opportunity  to  (1 )  formally  attest  to  the  accuracy  and  completeness 
and  (2)  determine  if  their  components  are  on  track  to  achieve  audit 
readiness  in  2017.  DOD  officials  also  stated  that  each  military 
department’s  CMO  reports  on  audit  readiness  progress  and 
challenges  in  signed  statements  in  the  FIAR  Plan  Status  Report  and 
indicates  whether  the  military  department  is  on  track  to  achieve  audit 
readiness  by  September  30,  2017.  However,  we  consider  this 
recommendation  to  be  partially  met  because  all  FIAR  Governance 
Board  members  need  to  attest  for  their  individual  components,  and 
the  DOD  Comptroller  needs  to  attest  for  the  department,  whether  they 
are  on  track  to  achieve  audit  readiness  in  2017  in  each  FIAR  Plan 
Status  Report  to  fully  meet  this  recommendation.  In  making  these 
attestations,  it  is  critical  that  the  FIAR  Governance  Board  consider  the 
effect  of  known  factors  (e.g.,  the  lack  of  integrated  systems)  and  other 
risks,  such  as  weaknesses  and  deficiencies  that  may  be  identified  in 
examinations  and  audits,  on  the  status  of  their  respective 
components’  financial  statement  audit  readiness. 

•  The  panel  required  DOD  to  (1)  include  objective  and  measurable 
criteria  regarding  FIAR-related  goals  in  its  senior  personnel 
performance  plans  and  evaluations,  (2)  appropriately  reward  or  hold 
officials  accountable  based  on  evaluated  performance  against  the 
FIAR-related  goals,  and  (3)  document  and  track  evaluated 
performances  to  measure  progress  overtime  (2.1).  On  April  9,  2013, 


^°The  FIAR  Governance  Board  is  charged  with  providing  vision,  leadership,  oversight,  and 
accountability  for  the  FIAR  effort.  Members  of  the  board  include,  among  others,  the 
Comptroller/Chief  Financial  Officer,  the  Deputy  Chief  Financial  Officer,  the  DCMO,  and  the 
military  department  deputy  chief  management  officers. 
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the  Deputy  Secretary  of  Defense  issued  a  memorandum,  stating  that 
most,  if  not  all,  of  DOD’s  executives  have  a  role  in  its  effort  to  achieve 
audit  readiness  and  that  Senior  Executive  Service  (SES)  performance 
plans  were  to  be  updated  with  FIAR-related  goals  by  April  30,  2013/^ 
We  consider  this  recommendation  partially  met  because,  although 
DOD  components  have  inserted  FIAR-related  requirements  in  SES 
performance  plans,  they  have  not  yet  determined  how  to  reward 
executives  based  on  evaluated  performance  for  FIAR-related  goals 
and  assessed  the  effect  on  accomplishing  FIAR  activities  by  tracking 
evaluated  performances  over  time. 

•  To  improve  oversight  of  the  FIAR  effort,  the  panel  recommended  that 
DOD  require  each  component  senior  executive  committee  to  review 
its  corresponding  component’s  audit  readiness  assertion  packages  for 
compliance  with  FIAR  Guidance  before  submitting  those  packages  to 
the  Office  of  the  Under  Secretary  of  Defense  (Comptroller)  for 
validation  (2.2).  DOD  considers  the  recommendation  to  be  met 
because  the  FIAR  Guidance  states  that  management’s  audit 
readiness  assertions  must  be  signed  by  the  person,  individual,  or 
representative  of  the  organization  responsible  for  the  subject  matter 
(assessable  unit)  and  that  this  level  of  review  and  approval  is 
appropriate.  DOD  requires  review  of  the  assertion  package  in 
accordance  with  the  FIAR  Guidance,  but  we  consider  this 
recommendation  partially  met  because  the  FIAR  Guidance  does  not 
require  senior  executive  committee  reviews  of  audit  readiness 
assertion  packages  as  the  panel  recommended. 


DOD’s  Actions  Have 
Partially  Met  20  of  the 
Panel’s  Remaining 
Recommendations 


We  agree  with  DOD  that  the  department’s  actions  partially  met  the 
remaining  20  panel  recommendations,  described  below  by  the  four  areas 
of  the  panel’s  review,  and  continued  actions  are  needed.  However, 
additional  actions  beyond  what  DOD  indicated  is  planned  are  needed  in 
some  cases  to  fully  address  the  panel  recommendations.  See  appendix  I 
for  details  on  all  partially  met  recommendations,  including  actions  under 
way  or  additional  actions  needed  to  meet  these  recommendations. 


41 

The  memorandum  also  included  a  waiver  from  this  requirement  for  those  SES  members 
who  do  not  manage  resources  or  business  processes  and  do  not  have  a  role  in  achieving 
audit  readiness. 
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The  panel  made  six  recommendations  in  this  area,  including 
recommendation  1.6  discussed  above  that  DOD  considers  met  which  we 
consider  partially  met  and  the  remaining  five  for  which  we  agree  with 
DOD’s  determination  that  these  are  partially  met.  Two  of  the  five 
remaining  partially  met  recommendations  in  this  area  specifically  relate  to 
DOD’s  implementation  of  its  FIAR  strategy  and  methodology  (1.1  and 
1.4).  In  addition,  one  recommendation  relates  to  the  department’s 
process  for  consolidating  the  components’  financial  statements  to  prepare 
the  department-wide  consolidated  financial  statements  (1.2).  Another 
recommendation  is  related  to  the  valuation  of  mission-critical  assets  (1.3). 
The  other  remaining  partially  met  recommendation  relates  to  risk 
management  activities  associated  with  implementing  the  FIAR  Plan  (1.5). 

Although  some  actions  have  been  taken,  continued  actions  are  needed  to 
address  all  recommendations  in  this  area,  and  additional  actions  are 
needed  for  some.  For  example,  the  panel  recommended  that  the 
Comptroller’s  office,  in  consultation  with  DOD’s  DCMO,  the  secretaries  of 
the  military  departments,  and  the  heads  of  the  defense  agencies  and  field 
activities,  incorporate  risk  mitigation  plans  to  support  meeting  future 
interim  milestones  in  the  FIAR  Plan  (1.5).  As  we  reported  in  August  2013, 
DOD  officials  acknowledged  that  there  is  not  a  department-wide  written 
risk  management  policy  for  its  FIAR  effort. DOD  officials  had  stated 
earlier  that  a  department-wide  risk  management  plan  would  aid  in 
assessing  and  integrating  risk  strategies  across  the  department. 

However,  instead  of  a  department-wide  risk  management  plan,  DOD  is 
using  a  three-pronged  approach  to  address  aspects  of  risk  management, 
as  stated  in  its  May  2015  FIAR  Plan  Status  Report. While  DOD’s  three¬ 
pronged  approach  to  address  risk  management  includes  the  use  of  “deal- 
breakers,”  DOD’s  critical  path,  and  its  centralized  notices  of  findings  and 
recommendations  tracking  database,  a  department-wide  risk 
management  plan,  as  DOD  had  previously  planned  to  implement,  is 


^^GAO,  DOD  Financial  Management:  Ineffective  Risk  Management  Could  Impair  Progress 
toward  Audit-Ready  Financial  Statements,  GAO-13-123  (Washington,  D.C.:  Aug.  2,  2013). 

■’^^The  department’s  three-pronged  approach  for  addressing  risk  management  includes 
(1 )  identifying  audit  readiness  deal-breakers  by  reviewing  past  audits,  (2)  defining  the 
critical  path  to  achieving  financial  statement  auditability  and  included  related  tasks  and 
milestones  in  the  April  2015  FIAR  Guidance,  and  (3)  reinforcing  the  importance  of  internal 
controls  over  areas  of  significant  risk  by  including  a  new  chapter  on  internal  controls  in  the 
FIAR  Guidance  and  implementing  a  centralized  tracking  database  to  monitor  corrective 
actions  developed  in  response  to  notices  of  findings  and  recommendations  generated 
from  audits  and  examinations. 
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Financial  Management 
Workforce 


needed  for  developing  and  implementing  consistent  risk  mitigation 
strategies  across  DOD  and  thus  to  support  meeting  future  interim 
milestones  as  called  for  in  the  recommendation. 

The  panel  made  nine  recommendations  in  this  area,  including  two 
recommendations  previously  discussed  that  DOD  considers  met  and  we 
consider  partially  met  (2.1  and  2.2)  and  two  recommendations  that  we 
agree  have  been  met  (2.5  and  2.8).  For  the  remaining  five 
recommendations,  we  agree  with  DOD’s  determination  that  they  are 
partially  met.  These  five  relate  to  addressing  existing  material 
weaknesses  and  those  identified  during  the  FIAR  effort  (2.3),  reducing 
improper  payments  and  problem  disbursements  (2.4  and  2.6),  identifying 
and  institutionalizing  best  practices  (2.7),  and  ensuring  that  components 
and  service  providers  working  with  them  have  consistent  milestones  (2.9). 

Although  DOD  has  taken  some  actions  to  address  these 
recommendations,  continued  or  additional  actions  are  needed  as  detailed 
in  appendix  I.  For  example,  the  panel  recommended  that  to  reduce 
problem  disbursements,  the  department  should  address  the  underlying 
causes  of  problem  disbursements  in  its  efforts  to  develop  and  implement 
ERP  systems  (2.6).  According  to  a  DOD  official,  the  implementation  of 
modern  financial  systems,  including  ERP  systems,  has  increased  the 
level  of  problem  disbursements  because  of  data  quality  issues  and 
interfaces  with  legacy  systems  that  are  still  in  use."^"^  The  DOD  official  also 
stated  that  when  the  ERP  systems  are  fully  implemented  and  operating  in 
the  stable  end  states,  these  systems  should  provide  an  automated, 
integrated  environment  that  will  significantly  reduce  the  number  of 
problem  disbursements.  In  its  May  2015  FIAR  Plan  Status  Report,  DOD 
officials  stated  that  analyses  to  assist  in  identifying  root  causes  and 
implementing  corrective  actions,  as  called  for  in  the  recommendation,  will 
be  performed  on  a  recurring  basis  until  the  department  can  retire  all 
legacy  systems  and  fully  implement  the  ERP  systems’  capabilities. 

The  panel  made  five  recommendations  in  this  area,  four  of  which  have 
been  met,  as  previously  discussed,  and  one  for  which  we  agree  with 
DOD’s  partially  met  assessment.  This  recommendation  relates  to  DOD 


^^Mark  Easton,  Deputy  Chief  Financial  Officer,  Department  of  Defense,  DOD’s  Efforts  to 
Improve  Payment  and  Funds  Control,  testimony  before  the  House  Committee  on  Armed 
Services,  Panel  on  Defense  Financial  Management  and  Auditability  Reform,  112th  Cong., 
1st  sess.,  September  22,  2011. 
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performing  a  department-wide  systematic  skills  assessment  of  its 
financial  management  workforce  and  that  of  all  other  functional  areas  that 
are  performing  financial  management-related  functions  (3.1).  The  panel 
recognized  the  importance  of  having  personnel  within  DOD’s  other 
functional  communities  who  are  skilled  in  performing  financial 
management-related  tasks,  because  these  communities  initiate  and 
maintain  much  of  the  financial  information  critical  to  the  results  of  DOD’s 
operations.'^®  DOD  completed  its  systematic  competency  assessment  of 
certain  occupations  in  its  financial  management  workforce  and  has  plans 
to  assess  the  remaining  financial  management  workforce  in  phases. 
However,  at  the  time  of  our  review,  DOD  had  not  yet  assessed  other 
functional  communities  as  called  for  by  the  panel  recommendation. 

The  panel  made  nine  recommendations  in  this  area,  and  we  agree  with 
DOD  that  all  of  these  recommendations  have  been  partially  met  and  none 
have  been  fully  met.  The  first  six  include  recommendations  relating  to 
ERP  schedule  delays  and  cost  overruns,  issues  with  the  requirements 
process,  and  the  capabilities  of  the  ERP  systems  to  achieve  FIAR 
objectives.  For  example,  the  panel  recommended  that  DOD  develop 
ERP-related  schedule  and  cost  estimates  based  on  best  practices  for 
future  ERP  deployments  (4.3).  While  the  Army  had  made  some 
improvements  to  the  schedule  and  cost  estimates  for  Army’s  Global 
Combat  Support  System  (GCSS-Army),'*®  we  reported  in  2014  that  DOD 
has  not  fully  implemented  best  practices  in  its  schedule  estimates,  cost 
estimates,  or  both  for  the  Defense  Enterprise  Accounting  and 
Management  System"^^  and  GCSS-Army."^®  The  panel  also  made  two 
recommendations  to  address  its  concerns  about  DOD’s  data  conversion 
efforts  and  the  numerous  interfaces  that  exist  and  their  possible 
compromising  of  ERP  functionality.  The  panel’s  final  recommendation 


'^®DOD  defines  a  functional  community  as  employees  who  perform  similar  functions. 

DOD’s  22  functional  communities  include  financial  management,  acquisition,  logistics, 
science  and  technology,  and  human  resources. 

'^^These  schedule  and  cost  estimates  supported  the  December  2012  full  deployment 
decision  for  GCSS-Army. 

'^^GAO,  DOD  Business  Systems  Modernization:  Air  Force  Business  System  Schedute  and 
Cost  Estimates,  GAO-14-152  (Washington,  D.C.:  Feb.  7,  2014). 

4ft 

GAO,  DOD  Business  Systems  Modernization:  Additionai  Enhancements  Are  Needed  for 
Army  Business  System  Scheduie  and  Cost  Estimates  to  Fuity  Meet  Best  Practices, 
GAO-14-470  (Washington,  D.C.:  Sept.  30,  2014). 
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related  to  DOD’s  assessment  of  information  systems  controls  testing 
needs  for  all  ERP  systems  being  developed  and  determination  of  whether 
appropriate  workforce  levels  and  corresponding  skill  sets  exist  within 
DOD’s  developmental  and  operational  test  communities. 

As  detailed  in  appendix  I,  the  department  needs  to  continue  taking 
actions  to  address  all  of  these  recommendations  and  take  additional 
actions  for  some.  For  example,  as  mentioned  above,  the  panel 
recommended  that  among  other  things,  DOD  evaluate  lessons  learned 
from  previous  data  conversion  efforts  and  incorporate  these  lessons  into 
its  ERP  conversion  plans  as  well  as  assess  the  merits  of  designating  a 
senior  official  to  be  responsible  for  the  coordination  and  managerial 
oversight  of  data  conversion  (4.7).  Although  DOD  assessed  the  merits  of 
designating  a  senior  official  responsible  for  data  conversion  and  identified 
lessons  learned  from  previous  data  conversion  efforts,  as  DOD 
implements  ERP  systems,  the  department  needs  to  continue  to 
incorporate  lessons  learned  into  its  current  and  future  ERP  data 
conversion  plans,  as  recommended  by  the  panel.  Given  that  DOD 
officials  have  stated  that  these  ERP  systems  are  critical  to  DOD’s  ability 
to  achieve  audit  readiness,  fully  implementing  these  recommendations 
will  be  necessary  for  achieving  this  goal. 


Conclusions 


The  panel’s  report  and  its  recommendations  touch  on  some  of  the  most 
critical  challenges  the  department  faces  in  achieving  lasting  financial 
management  improvements  and  financial  statement  audit  readiness.  As 
previously  stated,  DOD  has  defined  audit  readiness  to  mean  that  the 
department  has  strengthened  internal  controls  and  improved  financial 
practices,  processes,  and  systems  so  that  there  is  reasonable  confidence 
that  the  information  can  withstand  an  audit  by  an  independent  auditor. 
DOD’s  actions  to  meet  the  panel’s  29  recommendations,  if  effectively 
designed  and  implemented,  will  bring  the  department  closer  to  achieving 
these  important  goals.  However,  it  is  important  to  note  that 
implementation  of  the  panel’s  recommendations  may  not  include  all  of  the 
actions  that  the  department  must  take  to  achieve  auditable  financial 
statements.  As  the  DOD  IG  and  the  IPA  firms  perform  examinations  and 
audits,  they  may  identify  deficiencies  in  controls  that  may  not  have 
previously  been  known  and  as  such  were  not  addressed  by  the  panel’s 
recommendations.  Nonetheless,  without  taking  the  actions  needed  to  fully 
implement  the  panel  recommendations,  DOD  is  at  increased  risk  of  not 
achieving  its  financial  management  improvement  and  audit  readiness 
goals.  DOD  is  monitoring  its  progress  implementing  the  FIAR  Plan 
against  interim  milestones.  However,  as  the  target  date  for  validating 


Page  24 


GAO-15-463  HASC  Panel  Recommendations 


DOD’s  audit  readiness  approaches,  as  we  have  previously  stated,  DOD 
has  emphasized  asserting  audit  readiness  by  set  dates  over  assuring  that 
processes,  systems,  and  controls  are  effective,  reliable,  and  sustainable. 
While  time  frames  are  important  for  measuring  progress,  DOD  should  not 
lose  sight  of  the  ultimate  goal  of  implementing  lasting  financial 
management  reform  to  ensure  that  it  can  routinely  generate  reliable, 
auditable  financial  information  and  other  information  critical  to  decision 
making  and  effective  operations. 

Recommendation  for 
Executive  Action 

To  help  meet  its  financial  management  improvement  and  audit  readiness 
goals,  we  recommend  that  the  Secretary  of  Defense  direct  the  Under 
Secretary  of  Defense  (Comptroller)  to  reconsider  the  status  of  the  three 
panel  recommendations  that  DOD  classified  as  met  that  we  determined 
were  partially  met  and  take  the  necessary  actions  to  reasonably  assure 
that  these  recommendations  have  been  met. 

Agency  Comments 
and  Our  Evaluation 

We  provided  a  draft  of  this  report  to  DOD  for  comment.  In  its  written 
comments,  reprinted  in  appendix  II,  DOD  concurred  with  our 
recommendation  to  reconsider  whether  further  actions  are  needed  to 
meet  panel  recommendations  1.6,  2.1,  and  2.2.  DOD  also  described 
planned  actions  that  it  will  take  to  address  the  recommendations.  For 
panel  recommendation  2.2,  DOD  stated  that  it  will  update  the  FIAR 
Guidance  to  require  dual  signatures  from  both  the  senior  executives  in 
charge  of  financial  and  relevant  functional  areas  for  the  subject 
assertions.  As  DOD  updates  its  FIAR  Guidance,  DOD  should  require 
each  component  senior  executive  committee  to  review  its  corresponding 
component’s  audit  readiness  assertion  package  as  called  for  by  the  panel 
recommendation,  rather  than  focus  on  dual  signatures.  DOD  stated  that  it 
will  continue  to  provide  status  updates  on  actions  planned  and  completed 
for  the  remaining  23  panel  recommendations  in  its  semiannual  FIAR  Plan 
Status  Report. 

We  are  sending  copies  of  this  report  to  the  appropriate  congressional 
committees,  the  Secretary  of  Defense,  and  the  Under  Secretary  of 
Defense  (Comptroller).  In  addition,  the  report  is  available  at  no  charge  on 
the  GAO  website  at  http://www.gao.gov. 

If  you  or  your  staff  have  any  questions  about  this  report,  please  contact 
me  at  (202)  512-9869  or  khana@gao.gov.  Contact  points  for  our  Offices 
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of  Congressional  Relations  and  Public  Affairs  may  be  found  on  the  last 
page  of  this  report.  GAO  staff  members  who  made  key  contributions  to 
this  report  are  listed  in  appendix  III. 


Director 

Financial  Management  and  Assurance 
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Appendix  I:  Status  of  DOD’s  Actions  to 
Implement  the  Panel  on  Defense  Financial 
Management  and  Auditability  Reform 
Recommendations 


This  appendix  contains  our  assessment  of  the  Department  of  Defense’s 
(DOD)  progress  in  addressing  the  House  Armed  Services  Committee 
(HASC)  Panel  on  Defense  Financial  Management  and  Auditability 
Reform’s  (the  panel)  recommendations,  organized  by  the  four  areas  the 
panel  reviewed^  Each  section  of  the  appendix  covers  the 
recommendations  made  for  the  four  areas  and  includes  (1 )  the  panel 
recommendations,  (2)  statuses  reported  by  GAO  and  DOD,  (3)  key 
background  information,  (4)  DOD  actions  taken  to  address  the 
recommendations,  and  (5)  our  assessment  of  the  status  of  the 
recommendations.  The  status  of  each  recommendation  is  based  on  our 
assessment  of  information  received  prior  to  or  as  of  May  2015  and  DOD’s 
reported  status  as  of  the  May  2015  Financial  Improvement  and  Audit 
Readiness  (FIAR)  Plan  Status  Report.^ 


FIAR  Strategy  and 

Panel  recommendation  1.1 

Methodology 

The  Department’s  FIAR  Strategy  for  Wave  4  (Full  Audit  Except  for  Legacy  Asset 

Valuation)  should  include  a  complete  analysis  of  interdependencies  among  Waves  1-3 

and  Wave  4. 

GAO  status:  Partially  met 

DOD  status:  Partially  met 

Sources;  House  Armed  Services  Committee  Panel  on  Defense  Rnancial  Management  and  Auditability  Reform,  Findings  and 
Recommendations  (Washington,  O.C.:  Jan.  24, 2012);  Department  of  Defense  (FIAR  Plan  Status  Report,  May  201 5);  and  GAO 
(analysis).  |  GAO-15-463 


Background:  The  panel  reported  that  DOD  had  a  reasonable  strategy 
and  methodology  for  its  FIAR  effort,  although  its  strategy  needed  to  be 
more  detailed  and  refined.^  While  the  panel  noted  that  DOD’s  December 
201 1  FIAR  Guidance  detailed  the  strategy  and  methodology  for 
completing  Wave  4,  the  components  were  instructed  to  continue  their 


^  House  Armeii  Services  Committee  Panel  on  Defense  Financial  Management  an(j 
Auditability  Reform,  Findings  and  Recommendations  (Washington,  D.C.:  Jan.  24,  2012). 

^DOD  provides  semiannual  FIAR  Plan  Status  Reports  with  updates  on  the  status  of  the 
department’s  implementation  of  the  FIAR  Plan.  DOD’s  FIAR  Plan  is  DOD’s  strategic  plan 
and  management  tool  for  guiding,  monitoring,  and  reporting  on  the  department’s  financial 
management  improvement  efforts. 

^DOD’s  FIAR  strategy  includes  four  waves;  (1 )  Appropriations  Received  Audit, 

(2)  Schedule  of  Budgetary  Activities/Statement  of  Budgetary  Resources  Audit,  (3)  Mission 
Critical  Asset  Existence  and  Completeness  Audit,  and  (4)  Full  Financial  Statements  Audit. 
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focus  on  implementing  the  requirements  of  Waves  1, 2,  and  3^ 
Additionally,  the  panel  reported  that  the  department,  in  its  FIAR 
Guidance,  instructed  its  components  not  to  address  Wave  4  requirements 
in  their  financial  improvement  plans  (FIP)  until  the  FIAR  activities 
associated  with  Waves  1, 2,  and  3  were  complete.^  The  panel  stated  its 
concern  that  this  approach  may  affect  the  department’s  ability  to  achieve 
financial  statement  auditability  in  2017,  because  of  DOD’s  lack  of  analysis 
of  the  interdependencies  among  Waves  1,2,3,  and  4.  For  example,  the 
panel  stated  that  by  testing  certain  information  on  the  Statement  of 
Budgetary  Resources  (SBR)  in  Wave  2,  assurance  can  be  obtained  on 
the  reliability  of  certain  data  in  the  Balance  Sheet  in  Wave  4. 

DOD  Actions:  DOD  first  identified  interdependencies  in  its  December 
201 1  FIAR  Guidance  that  can  be  leveraged  to  accelerate  progress  in 
Wave  4  and  revised  them  in  subsequent  versions  of  the  FIAR  Guidance 
as  follows:® 

•  Delivered  Orders,  reported  on  the  SBR  (covered  in  Wave  2),  equates 
to  a  portion  of  Accounts  Payable  reported  on  the  Balance  Sheet 
(Wave  4). 

•  Spending  Authority  from  Offsetting  Collections,  reported  on  the  SBR 
(covered  in  Wave  2),  includes  some  of  the  amounts  reported  in 
Accounts  Receivable — Intragovernmental  on  the  Balance  Sheet 
(Wave  4). 


"*The  FIAR  Guidance,  which  is  updated  periodically,  provides  the  standard  methodology 
for  the  components  to  implement  the  FIAR  Plan.  The  FIAR  Guidance  requires 
components  to  develop  and  execute  corrective  action  plans  to  remediate  any  deficiencies 
that  indicate  that  controls  are  not  working,  transaction  amounts  are  not  supported,  or  both. 

®FIPs  provide  a  framework  for  planning  and  tracking  the  steps  and  supporting 
documentation  necessary  to  achieve  auditability  within  the  FIAR  methodology. 

®DOD  officials  stated  that  there  are  no  interdependencies  for  Wave  3  (Mission  Critical 
Asset  Existence  and  Completeness  Audit)  with  Waves  1  (Appropriations  Received  Audit) 
and  2  (Statement  of  Budgetary  Resources  Audit). 
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•  Unobligated  Balances  and  Unpaid  Obligations,  reported  on  the  SBR 
(covered  in  Wave  2),  correlates  to  Fund  Balance  with  Treasury, 
reported  on  the  Balance  Sheet  (Wave  A)J 

•  Obligations  Incurred,  reported  on  the  SBR  (covered  in  Wave  2), 
equates  to  a  substantial  portion  of  Gross  Costs  reported  on  the 
Statement  of  Net  Cost  (Wave  4). 

In  its  May  2015  FIAR  Plan  Status  Report,  DOD  considered  this 
recommendation  as  partially  met  and  stated  that  its  analysis  of 
interdependencies  will  continue  until  the  department  achieves  financial 
statement  auditability.  Also,  in  its  April  2015  FIAR  Guidance,  DOD  stated 
that  partly  because  of  interrelationships  between  financial  statements,  the 
department  can  leverage  audit  readiness  efforts  from  previous  waves  to 
succeeding  waves,  much  like  the  above  interdependencies.  For  example, 
DOD  officials  stated  that  through  Schedule  of  Budgetary  Activity/SBR 
(Wave  2)  audit  readiness  efforts,  some  portions  of  line  items  on  other 
financial  statements  have  been  addressed. 

GAO  Status:  We  consider  this  recommendation  partially  met  because  as 
DOD  continues  its  audit  readiness  activities,  the  department  will  likely 
identify  additional  interdependencies  between  accounts  on  its  SBR, 
Balance  Sheet,  and  Statement  of  Net  Cost.  For  example.  Wave  4  audit 
readiness  activities  include  valuation  of  assets,  liabilities,  revenues,  and 
costs  and  therefore  will  require  DOD  to  determine  the  dollar  values  to  be 
assigned  to  line  items  such  as  environmental  liabilities;  general  property, 
plant  and  equipment;  inventory;  and  operating  materials  and  supplies. 
These  audit  readiness  activities  will  involve  interdependencies  between 
the  Balance  Sheet  and  the  Statement  of  Net  Cost. 


^DOD  stated  that  the  most  important  financial  relationships  for  Wave  2  are  found  between 
the  SBR  and  the  Balance  Sheet.  Because  of  the  strong  relationship  between  the  Fund 
Balance  with  Treasury  line  item  on  the  Balance  Sheet  and  line  items  on  the  SBR, 
achieving  an  auditable  Fund  Balance  with  Treasury  balance  is  critical  to  achieving 
successful  completion  of  Wave  2. 
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Panel  recommendation  1.2 

The  Department  should  establish  a  DOD  Financial  Reporting  element,  or  wave,  that 
includes  a  process  for  consolidating  the  components'  financial  information  into  the 
DOD’s  agency-wide  financial  statements.  The  Department  should  report  this  element’s 
audit  readiness  progress  in  the  FIAR  Plan  Status  Report. 

GAO  status:  Partially  met 
DOD  status:  Partially  met 

Sources:  House  Armed  Services  Comrnttee  Panel  on  Defense  Rnandal  Management  and  Auditability  Reform,  Findings  and 
Recommendations  (Washington,  O.C.:  Jan.  24, 2012);  Department  of  Defense  (FIAR  Plan  Status  Report,  May  2015);  and  GAO 
(analysis).  |  (^0-15463 

Background:  The  panel  stated  that  the  FIAR  Plan  did  not  address  the 
process  for  ensuring  that  the  DOD  components’  financial  information  will 
be  properly  consolidated  into  DOD’s  department-wide  financial 
statements.  The  panel’s  concern  was  that  the  lack  of  an  articulated 
process  for  addressing  financial  statement  consolidation  may  affect 
DOD’s  ability  to  achieve  financial  statement  auditability  in  2017.  In  its 
recommendation,  the  panel  suggested,  as  one  option,  that  DOD  create  a 
DOD  financial  reporting  element  or  wave  for  consolidation  of  DOD’s 
financial  statements  and  report  on  this  element’s  audit  readiness  progress 
in  the  FIAR  Plan  Status  Report. 

DOD  Actions:  DOD  reports  on  the  status  of  Defense  Finance  and 
Accounting  Service  (DFAS)  financial  reporting,  defined  as  the  process  by 
which  DFAS  organizes  financial  data  and  produces  financial  statements, 
in  the  FIAR  Plan  Status  Reports.  DFAS,  one  of  DOD’s  largest  service 
providers,®  performs  accounting  and  finance  services  for  the  department, 
including  preparing  the  financial  statements  for  its  components  as  well  as 
the  consolidated  department-wide  financial  statements.®  According  to 
DOD  officials,  the  department  will  continue  to  use  the  current  DFAS 
reporting  system  and  processes  to  produce  the  department-wide 
consolidated  financial  statements.  In  accordance  with  the  FIAR  Guidance, 
DFAS’s  financial  reporting  system  and  processes  have  undergone  a 
Statement  on  Standards  for  Attestation  Engagements  (SSAE)  No.  16 


®DOD,  in  its  FIAR  Guidance,  has  defined  service  providers  as  “entities  that  provide 
services  to  and  are  responsible  for  executing  one  or  more  business  processes  on  behalf 
of  the  reporting  entities.” 

®Underthe  FIAR  Guidance,  DOD  components  include  reporting  entities  (i.e.,  DOD  entities 
or  funds  that  prepare  stand-alone  financial  statements  included  in  the  DOD-wide  financial 
statements)  and  service  providers  that  provide  a  variety  of  accounting,  personnel, 
logistics,  systems,  or  other  support  services  to  the  reporting  entities. 
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examination  by  an  independent  auditor. As  DOD  officials  stated  in  the 
May  2015  FIAR  Plan  Status  Report,  the  department  is  addressing  the 
SSAE  No.  16  reported  findings  and  implementing  corrective  actions. 
However,  DOD  officials  stated  in  the  report  that  the  department  will  not 
know  whether  outstanding  issues  related  to  financial  statement 
compilation  have  been  resolved  until  an  audit  of  DOD’s  department-wide 
financial  statements  has  been  conducted. 

GAO  Status:  DOD  has  established  financial  reporting  assessable  units 
for  the  military  departments  and  service  providers.  However,  we  consider 
this  recommendation  partially  met  because  DOD  needs  to  take  additional 
actions  to  fully  develop  a  financial  reporting  wave  or  strategy  for 
consolidating  individual  component  financial  statements  into  department¬ 
wide  financial  statements.  In  addition,  DOD’s  reporting  system  and 
processes  do  not  allow  for  the  elimination  of  intragovernmental 
transactions,  which  occur  between  federal  entities  and  must  be  eliminated 
to  prevent  duplicate  reporting  of  information.  DFAS,  in  its  SSAE  No. 16 
financial  reporting  assertion  package,  stated  that  DOD’s  current 
accounting  systems  generally  do  not  capture  trading  partner  information 
at  the  level  needed  to  match  and  eliminate  these  intragovernmental 
transactions  between  trading  partners. DOD  officials  stated  that  they 
have  actions  under  way  to  address  the  issues  affecting  the  proper 
elimination  of  intragovernmental  transactions. 


1  n 

In  accordance  with  SSAE  No.  16,  Reporting  on  Controls  at  a  Service  Organization,  the 
auditors  of  each  of  these  external  service  organizations  issue  reports  concerning  the 
design  and  operating  effectiveness  of  the  service  organizations’  internal  control  over  the 
processing  of  user  transactions.  Services  provided  by  an  external  service  organization  are 
considered  part  of  a  user  entity’s  information  system  relevant  to  the  user  entity’s  financial 
reporting  if  the  services  affect  classes  of  transactions  that  are  significant  to  the  user 
entity’s  financial  statements  as  well  as  the  financial  reporting  process  used  to  prepare  the 
financial  statements. 

^^Trading  partners  are  federal  agencies,  bureaus,  programs,  or  other  entities  (within  or 
between  entities)  participating  in  transactions  with  each  other. 
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Panel  recommendation  1.3 

The  DOD  should  re-evaluate  its  position  on  accepting  historical  asset  costs  when 
the  Department  nears  auditability  on  its  financial  statements  in  light  of  certain 
allowances  in  federal  accounting  standards.  The  findings  of  a  re-evaluation  may 
support  the  development  of  an  audit  readiness  strategy  for  valuing  legacy  asset 
balances. 

GAO  status:  Partially  met 
DOD  status:  Partially  met 

Sources;  House  Armed  Services  Committee  Pane]  on  Defense  Rnandal  Management  and  Auditability  Reform,  Findings  and 
Recommendadons  (Washington.  D.C.:  Jan.  24. 2012);  Department  of  Defense  (FIAR  Plan  Status  Report,  May  2015);  and  GAO 
(analysis).  |  GAO-15-463 


Background:  When  the  panel  made  its  recommendation,  DOD  had 
decided  to  wait  to  report  the  historical  costs  of  real  property,  general 
equipment,  inventory,  and  operating  materials  and  supplies  on  its 
Balance  Sheet  until  (1)  initial  FIAR  priorities  had  been  met  and  (2)  the 
enterprise  resource  planning  (ERP)  systems  under  development  were 
capable  of  recording  and  reporting  transaction  data.^^  DOD’s  decision 
was  based  on  its  business  case  in  which  DOD  officials  stated  that  with 
the  exception  of  operating  materials  and  supplies,  historical  acquisition 
cost  information  was  used  exclusively  for  financial  reporting  and  not  for 
managerial  decision  making.  DOD  officials,  in  its  business  case,  also 
recognized  that  the  ongoing  implementation  of  ERP  systems  would 
enhance  the  recording  of  auditable  historical  costs  for  future  acquisitions. 
Based  on  its  business  case,  DOD  also  decided  that  it  would  expense  the 
costs  of  military  equipment  and  request  that  the  Federal  Accounting 
Standards  Advisory  Board  change  the  federal  accounting  standards  to 
allow  this  treatment,  because  DOD  viewed  capturing,  recording,  and 
reporting  auditable  costs  for  military  equipment  as  extremely  challenging 
and  costly. In  its  report,  the  panel  noted  that  federal  accounting 
standards  allow  for  the  use  of  other  methods  to  provide  reasonable 
estimates  for  the  costs  of  these  assets,  which  led  to  its  recommendation 
that  the  department  reevaluate  its  position  on  accepting  historical  costs. 


ERP  system  is  an  automated  system  using  commercial  off-the-shelf  software 
consisting  of  multiple,  integrated  functional  modules  that  perform  a  variety  of  business- 
related  tasks,  such  as  general  ledger  accounting,  payroll,  and  supply  chain  management. 

^^Military  equipment  is  weapon  systems  that  can  be  used  directly  by  the  armed  forces  to 
carry  out  battlefield  missions  and  includes  aircraft,  ships,  tanks,  and  self-propelled 
weapons. 
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DOD  Actions:  DOD  has  reevaluated  its  position  from  that  described  in  its 
business  case,  deciding  to  include  historical  cost  valuations  of  general 
property,  plant  and  equipment,  including  general  equipment  as  well  as 
real  property,  and  internal  use  software  on  its  Balance  Sheet,  without 
waiting  until  initial  FIAR  priorities  are  met  and  the  implementation  of  the 
ERP  systems  is  complete. In  September  2013,  DOD  described  its 
overall  strategy  for  valuing  assets  (1)  acquired  prior  to  October  1, 2013, 
and  (2)  accepted  by  DOD  and  placed  into  service  on  or  after  October  1 , 
2013.''^  In  February  2014,  DOD  issued  its  general  equipment  valuation 
estimation  methodologies.''®  According  to  its  May  2015  FIAR  Plan  Status 
Report,  DOD  has  established  five  working  groups  that  are  addressing 
impediments  to  audit  readiness,  including  the  valuation  of  historical 
assets.'^  DOD  reported  the  status  of  this  recommendation  as  partially  met 
and  stated  that  the  valuation  methods  for  various  asset  categories  are 
being  developed  and  that  the  department  is  working  closely  with  the 
Federal  Accounting  Standards  Advisory  Board  to  leverage  asset  valuation 
methodologies  allowed  under  Statement  of  Federal  Financial  Accounting 
Standards  No.  35  to  establish  a  historical  cost  baseline.''® 

GAO  Status:  We  consider  this  recommendation  partially  met  because 
DOD  has  developed  a  strategy  and  is  basing  its  asset  valuation  for  the 
Balance  Sheet  on  historical  cost,  but  the  department  faces  significant 
challenges  in  continuing  to  implement  its  strategy  and  develop  auditable 


14 

Department  of  Defense,  Office  of  the  Under  Secretary  of  Defense  (Comptroller)/Chief 
Financial  Officer,  “Business  Case  Analysis,”  app.  3  of  Financial  Improvement  and  Audit 
Readiness  (FIAR)  Plan  Status  Report  (Washington,  D.C.:  May  201 1 ). 

^®Department  of  Defense,  Office  of  the  Secretary  of  Defense,  Elimination  of  Military 
Equipment  Definition  and  Increase  to  Capitalization  Thresholds  for  General  Property, 
Plant  and  Equipment  (VJashmgton,  D.C.:  Sept.  20,  2013). 

^®Department  of  Defense,  Office  of  the  Under  Secretary  of  Defense  (Acquisition, 
Technology  and  Logistics),  Property  and  Equipment  Policy  Office,  General  Equipment 
Valuation  Estimation  Methodologies  (Washington,  D.C.:  Feb.  21, 2014). 

^^The  five  Balance  Sheet  working  groups  are  the  (1)  General  Equipment  working  group, 
(2)  Real  Property  working  group,  (3)  Internal  Use  Software  working  group,  (4)  Inventory 
and  Related  Property  working  group,  and  (5)  Environmental  and  Disposal  Liabilities 
working  group. 

1  ft 

Federal  Accounting  Standards  Advisory  Board,  Statement  of  Federal  Financial 
Accounting  Standards  35:  Estimating  the  Historical  Cost  of  General  Property,  Plant,  and 
Equipment:  Amending  Statements  of  Federal  Financial  Accounting  Standards  6  and  23 
(Washington,  D.C.:  Oct.  14,  2009). 
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valuations  for  these  assets.  For  example,  DOD’s  components  must  first 

determine  the  existence  of  these  assets,  in  addition,  DOD  has  cited  the 

following  challenges  to  asset  valuation; 

.  numerous  configurations  of  highly  complex  military  equipment  and 
weapons  systems; 

•  military  equipment  and  weapons  systems  that  have  been  modified, 
upgraded,  or  overhauled; 

•  renovated  or  improved  real  property  assets  that  have  changed  in 
value  since  originally  placed  in  service; 

•  large  inventories  of  missiles,  ammunition  and  munitions,  spare 
engines,  equipment  parts,  supplies,  and  so  forth; 

•  enormous  quantities  of  deployed  general  equipment,  inventory,  and 
operating  materials  and  supplies  located  in  Afghanistan  and 
worldwide;  and 

•  identification  and  valuation  of  internal  use  software  and  DOD  property 
with  contractors. 


Panel  recommendation  1 .4 

The  Department  should:  (1)  analyze  the  causes  of  FIAR  Plan  implementation  difficulties; 
(2)  develop  and  implement  corrective  action  plans  to  address  identified  weaknesses  or 
deficiencies;  and  (3)  develop  a  communications  plan  to  circulate  any  resulting  lessons- 
learned  throughout  the  Department. 

GAO  status:  Partially  met 
DOD  status:  Partially  met 

Sources:  House  Armed  Services  Committee  Panel  on  Defense  Rnandal  Management  and  Auditability  Reform,  Firnlings  and 
Recommendations  (Washington.  D.C.:  Jan.  24. 2012);  Department  of  Defense  (FIAR  Plan  Status  Report,  May  2015);  and  GAO 
(analysis).  |  GAO-15.463 


Background:  The  panel’s  concern  was  that  without  properly 
implementing  the  FIAR  methodology,  DOD  components  may  be 
prematurely  asserting  audit  readiness.  In  its  report,  the  panel  refers  to  our 
September  201 1  report  in  which  we  stated  that  the  Navy  and  Air  Force 
did  not  adequately  develop  and  implement  their  respective  FIPs^^  for 


■*®D0D  components  are  expected  to  prepare  FIPs  in  accordance  with  the  FIAR  Guidance 
for  each  of  their  assessable  units.  The  FIPs  are  intended  to  both  guide  and  document 
financial  improvement  efforts. 
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civilian  pay  and  military  equipment  in  accordance  with  the  FIAR 
Guidance. Our  review  of  the  FIPs  found  that  the  Navy  and  Air  Force  did 
not  conduct  sufficient  control  and  substantive  testing  and  reached 
conclusions  that  were  not  supported  by  the  testing  results,  did  not 
complete  reconciliations  of  the  population  of  transactions,  and  did  not  fully 
test  information  systems  controls.^''  Also,  neither  the  Navy  nor  the  Air 
Force  had  fully  developed  and  implemented  corrective  action  plans 
(CAPs)  to  address  deficiencies  identified  during  implementation  of  the 
FIPs.  As  a  result  of  these  deficiencies,  we  reported  that  these  FIPs  did 
not  provide  sufficient  support  for  the  components’  conclusions  that  the 
assessable  units  were  ready  to  be  audited. 

DOD  Actions:  With  regard  to  part  1  of  the  recommendation,  DOD’s  FIAR 
Directorate,^^  according  to  DOD  officials,  worked  with  DOD’s  components 
initially  to  overcome  FIAR  Plan  implementation  difficulties  by  reviewing 
and  verifying  that  the  FIPs  were  consistent  with  FIAR  strategy  and 
methodology.  Based  on  this  work,  the  FIAR  Directorate  identified  causes 
of  implementation  difficulties,  or  what  DOD  refers  to  as  deal-breakers — 
weaknesses  that  have  prevented  DOD  components  from  demonstrating 
audit  readiness  or  succeeding  in  audits. 

With  regard  to  part  2  of  the  recommendation,  DOD’s  March  2013  FIAR 
Guidance  accelerated  examination  of  audit  readiness  assertion  packages 
by  the  DOD  Inspector  General  (IG)  or  independent  public  accountant 
(IPA)  firms  to  identify  needed  corrective  actions  based  on  auditor- 


GAO,  DOD  Financial  Management:  Improvement  Needed  in  DOD  Components’ 
Implementation  of  Audit  Readiness  Effort,  GAO-11-851  (Washington,  D.C.:  Sept.  13, 
2011). 

^^While  “financial  improvement  plan”  indicates  that  it  is  a  plan,  as  a  military  department  or 
component  implements  that  plan,  it  must  document  the  steps  performed  and  the  results  of 
those  steps  and  retain  that  documentation  within  the  FIP.  Therefore,  a  FIP  includes  plans 
for  testing  controls  and  data  and  documentation  of  the  testing  conducted,  results  of  the 
testing,  and  any  actions  taken  based  on  the  results.  When  a  component  determines  that  it 
has  completed  sufficient  financial  improvement  efforts  for  an  assessable  unit  so  that  it  is 
ready  for  audit,  the  FIP  documentation  is  used  to  support  the  conclusion  of  audit 
readiness. 

^^The  FIAR  Directorate  provides  management  of  the  FIAR  Plan  to  ensure  integration  of 
DOD-wide  financial  improvement  efforts  through  various  activities,  including  (1)  the 
development  and  issuance  of  the  FIAR  Guidance,  (2)  performing  monthly  detailed  reviews 
of  component  FIPs  and  evaluating  related  deliverables,  and  (3)  the  development  of 
metrics  for  monitoring  and  progress  reporting. 
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identified  notices  of  findings  and  recommendations  by  combining  the 
Assertion  and  Evaluation  phases  into  one  phase. In  addition  to 
examinations  of  audit  readiness  assertion  packages,  audits  of  the  military 
departments’  General  Fund  Schedules  of  Budgetary  Activity  for  fiscal 
year  2015  began  in  January  2015.  The  FIAR  Directorate  has  established 
a  tracking  database  to  monitor  the  implementation  of  corrective  actions 
for  findings  and  recommendations  resulting  from  examinations  and 
audits. 

Finally,  with  regard  to  part  3  of  the  recommendation,  DOD  does  not  have 
a  formal  communications  plan  for  sharing  information  on  lessons  learned, 
but  the  FIAR  Directorate  promotes  this  type  of  sharing.  Lessons  learned 
are  shared  at  FIAR  Committee,  FIAR  Subcommittee,  and  working  group 
meetings,  as  well  as  other  forums  such  as  in-process  review  meetings 
and  newsletters.  According  to  the  May  2015  FIAR  Plan  Status  Report,  the 
tracking  database  for  notices  of  findings  and  recommendations  will  help  in 
sharing  lessons  learned  as  deficiencies  at  one  component  are  likely  to 
exist  at  another  component. 

GAO  Status:  We  consider  this  recommendation  partially  met  because 
DOD  components  have  not  yet  implemented  all  of  the  FIAR  audit 
readiness  activities  to  achieve  its  goal  of  department-wide  financial 
statement  auditability.  Furthermore,  the  expansion  of  the  FIAR  priorities 
to  include  proprietary  accounting  and  information  as  well  as  valuation  will 
likely  require  additional  corrective  actions  to  address  these  areas. As 
recommended  by  the  panel,  the  components  will  need  to  continue 
developing  CAPs  to  address  any  identified  weaknesses  or  deficiencies. 
Finally,  DOD  needs  to  develop  a  formal  communications  plan  and 


As  stated  in  the  March  2013  FIAR  Guidance,  the  six-phase  FIAR  methodology  was 
reduced  to  five  phases  when  the  Assertion  and  Evaluation  phases  were  combined  into 
one  phase.  This  phase  was  renamed  the  Assertion/Examination  phase  in  the  April  2015 
FIAR  Guidance. 

^^This  centralized  tracking  database  will  include  findings  and  recommendations  from 
(1)  DOD  or  IPAfirm  examinations  for  specific  assessable  units;  (2)  mock  audits;  (3)  SSAE 
No.  16  examinations;  and  (4)  audits  performed  by  IPA  firms,  GAO,  the  DOD  IG,  and  the 
military  departments’  audit  services. 

^^These  expanded  priorities  were  included  in  the  April  2015  FIAR  Guidance.  Proprietary 
accounts  provide  the  information  for  the  financial  statements  based  on  Federal  Accounting 
Standards  Advisory  Board  standards  and  are  intended  to  provide  an  economic  rather  than 
a  budgetary  measure  of  operations  and  resources. 
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components  will  need  to  communicate  any  lessons  learned  as  the  panel 
recommended. 


Panel  recommendation  1.5 

The  Under  Secretary  of  Defense  (Comptroller)  (USD(C)),  in  consultation  with  DOD’s 
Deputy  Chief  Management  Officer  (DCMO),  the  secretaries  of  the  military  departments, 
and  the  heads  of  the  defense  agencies  and  field  activities,  should  incorporate  risk 
mitigation  plans  to  support  the  meeting  of  future  interim  milestones  in  the  FIAR  Plan. 
GAO  status:  Partially  met 
DOD  status:  Partially  met 

Sources:  House  Armed  Services  Committee  Parcel  on  Defense  Rnandal  Management  and  Auditability  Reform,  Flings  and 
Recommenda&ons  (Washington.  O.C.:  Jan.  24. 2012);  Departing  of  Defense  (FIAR  Plan  Status  Report.  May  2015);  and  C3AO 
(analysis).  |  GAO-1S463 


Background:  The  panel  raised  concerns  about  DOD  missing  some  of  the 
interim  milestones  included  in  the  May  201 1  FIAR  Plan  Status  Report. 
While  recognizing  that  slippages  of  interim  milestones  will  not  necessarily 
compromise  meeting  audit  readiness  objectives,  the  panel  stated  that 
DOD  must  incorporate  risk  mitigation  plans  to  remediate  missed  interim 
milestones  and  apply  lessons  learned  toward  achieving  later  milestones 
on  schedule. 

DOD  Actions:  The  department,  in  its  May  2015  FIAR  Plan  Status  Report, 
stated  that  it  has  a  three-pronged  approach  for  addressing  risk 
management  in  which  DOD  has  (1)  identified  audit  readiness  deal- 
breakers  by  reviewing  past  audits,  (2)  defined  the  critical  path  to 
achieving  financial  statement  auditability  and  included  related  tasks  and 
milestones  in  the  April  2015  FIAR  Guidance,  and  (3)  reinforced  the 
importance  of  internal  controls  over  areas  of  significant  risk  by  including  a 
new  chapter  on  internal  controls  in  the  FIAR  Guidance  and  implementing 
a  centralized  tracking  database  to  monitor  corrective  actions  developed  in 
response  to  notices  of  findings  and  recommendations  generated  from 
examinations  and  audits.^ 

GAO  Status:  We  consider  this  recommendation  partially  met  because 
DOD  needs  to  take  additional  actions  to  develop  a  department-wide  risk 
management  plan.  In  August  2013,  we  recommended  that  DOD  design 


^^Examinations  of  audit  readiness  are  done  by  either  the  DOD  IG  or  an  IPA  firm. 
Examinations  are  different  from  financiai  statement  audits.  According  to  DOD,  auditors 
compiete  an  examination  to  vaiidate  management’s  assertion  that  the  business  or 
financiai  process  is  audit  ready. 
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and  implement  department-level  policies  and  detailed  procedures  for 
FIAR  Plan  risk  management,  including  the  five  guiding  principles  for 
effective  risk  management.^^  DOD  officials  acknowledged  that  DOD  did 
not  have  a  written  risk  management  policy  for  its  FIAR  effort  and  originally 
planned  to  develop  one,  but  have  recently  stated  that  its  three-pronged 
approach  will  address  risk  management.  According  to  the  May  2015  FIAR 
Plan  Status  Report,  DOD’s  three-pronged  approach  addresses  aspects  of 
risk  management,  including  the  use  of  deal-breakers,  DOD’s  critical  path, 
and  its  notices  of  findings  and  recommendations  tracking  database. 
However,  the  lack  of  a  department-wide  risk  management  plan  to  assess 
risks  specifically  related  to  meeting  future  interim  milestones  will  hinder 
developing  and  implementing  consistent  risk  mitigation  strategies  across 
DOD. 


Panel  recommendation  1.6 

The  FIAR  Governance  Board  should  attest  as  to  whether  the  DOD  is  on  track  to  achieve 
audit  readiness  in  2017  in  each  FIAR  Plan  Status  Report. 

GAO  status:  Partially  met 
DOD  status:  Met 

Sources:  House  Armed  Services  Committee  Panel  on  Defense  Rnandal  Management  and  Auditability  Reform,  Findings  and 
Recommendations  (Washington.  D.C.:  Jan.  24, 2012);  Department  of  Defense  (FIAR  Plan  Status  Report  May  201 5);  and  GAO 
(analysis).  |  GAO-15-463 

Background:  The  FIAR  Governance  Board  is  charged  with  providing 
vision,  leadership,  oversight,  and  accountability  for  DOD’s  FIAR  effort. 
Members  of  the  FIAR  Governance  Board  include  the  Comptroller/Chief 
Financial  Officer,  the  Deputy  Chief  Financial  Officer,  the  Deputy  Chief 
Management  Officer,  the  military  department  assistant  secretaries  for 
financial  management/comptroller  and  deputy  chief  management  officers 
(DCMO),  the  DFAS  Director,  and  Defense  Logistics  Agency  (DLA) 
Deputy  Director. 

DOD  Actions:  DOD  officials  stated  that  each  FIAR  Plan  Status  Report  is 
coordinated  among  FIAR  Governance  Board  members,  providing  them 
with  the  opportunity  to  (1)  formally  attest  to  the  accuracy  and 
completeness  and  (2)  determine  if  their  components  are  on  track  to 


^^GAO,  DOD  Financial  Management:  Ineffective  Risk  Management  Could  Impair  Progress 
toward  Audit-Ready  Financial  Statements,  GAO-13-123  (Washington,  D.C.:  Aug.  2,  2013). 
The  five  guiding  principles  for  effective  risk  management  are  (1 )  identify  risks,  (2)  analyze 
risks,  (3)  plan  for  risk  mitigation,  (4)  implement  the  risk  management  plan,  and  (5)  monitor 
risks. 
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achieve  audit  readiness  in  2017.  In  addition,  DOD  officials  stated  that 
each  military  department’s  chief  management  officer  reports  on  audit 
readiness  progress  and  challenges  in  signed  statements  in  the  FIAR  Plan 
Status  Report  and  also  indicates  whether  his  or  her  military  department  is 
on  track  to  achieve  audit  readiness  by  September  30,  2017. 

GAO  Status:  The  FIAR  Plan  Status  Reports  have  included  signed 
statements  by  the  military  department  chief  management  officers  as  well 
as  a  signed  statement  from  DOD’s  Under  Secretary  of  Defense 
(Comptroller)/Chief  Financial  Officer.  However,  we  consider  this 
recommendation  partially  met  because  not  all  FIAR  Governance  Board 
members  (e.g.,  the  DFAS  Director  and  the  DLA  Deputy  Director)  provide 
signed  statements  and  attest  to  audit  readiness  in  the  FIAR  Plan  Status 
Reports  and  thus  additional  actions  are  needed.  In  addition,  the  signed 
statements  provided  in  the  May  2015  FIAR  Plan  Status  Report  did  not 
explicitly  state  whether  DOD  was  on  track  to  achieve  audit  readiness  by 
September  30,  2017,  as  the  panel  recommended.  Instead,  the  signed 
statements  expressed  commitment  to  continue  making  progress  toward 
financial  statement  auditability  by  September  30,  2017,  but  did  not  clearly 
state  whether  DOD  or  the  military  departments  are  on  target  to  meet  that 
date.  Moreover,  because  the  panel  recommendation  is  addressed  to  the 
department,  the  FIAR  Governance  Board  members  need  to  attest  for  their 
individual  components  and  the  DOD  Comptroller  needs  to  attest  for  the 
department  whether  they  are  on  track  to  achieve  audit  readiness  in  2017 
in  each  FIAR  Plan  Status  Report  to  fully  meet  this  recommendation.  In 
making  these  attestations,  it  is  critical  that  the  FIAR  Governance  Board 
consider  the  effect  of  known  factors  (e.g.,  the  lack  of  integrated  systems) 
and  other  risks,  such  as  weaknesses  and  deficiencies  identified  in 
examinations  and  audits,  on  the  status  of  its  financial  statement  audit 
readiness. 


Challenges  to  Achieving 
Financial  Management 
Reform  and  Auditability 


Panel  recommendation  2.1 

The  Department  should  include  objective  and  measurable  criteria  regarding  FIAR-related 
goals  in  its  senior  personnel  performance  plans  and  evaluations.  Performance  evaluated 
on  the  basis  of  such  criteria  should  be  appropriately  rewarded  or  held  accountable. 
Evaluated  performances  should  be  documented  and  tracked  to  measure  progress  over 
time. 

GAO  status:  Partially  met 
DOD  status:  Met 

Sources:  House  Armed  Services  Committee  Panel  on  Defense  Rnandal  Management  and  Auditability  Reform,  FimJings  and 
Recommendations  (Washington,  D  C.:  Jan.  24,2012);  Department  of  Defense  (FIAR  Plan  Status  Report  May  2015);  and  GAO 
(analysis).  |  GAO-15-463 
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Background:  The  panel  stated,  in  its  report,  that  effective  leadership  and 
oversight  are  instrumental  to  bringing  forth  and  sustaining  substantial 
financial  management  improvement.  In  addition  to  financial  management 
reform  being  a  long-term  undertaking,  the  panel  stated  that  it  requires  the 
involvement  of  DOD  leadership  within,  and  outside  of,  financial 
management  operations.  In  addition,  according  to  the  panel,  leadership 
should  extend  from  the  top  officials,  including  the  offices  that  comprise 
the  Secretary  of  Defense,  the  military  departments’  chief  management 
officers,  and  the  military  departments’  assistant  secretaries  (financial 
management  and  comptroller)  to  senior  officials  in  other  functional  areas, 
such  as  logistics  and  acquisitions.  The  panel  recognized  that  DOD 
requires  that  senior  executive  performance  appraisals  include  financial 
audit  goals  among  their  evaluation  criteria  and  that  this  requirement 
includes  appraisals  of  senior  executives  in  functional  areas  having  a 
financial  impact.  The  panel  considered  this  requirement  a  positive  step, 
but  added  that  the  effectiveness  of  this  requirement  depends  on  whether 
the  evaluation  criteria  can  be  objectively  measured,  evaluated 
performances  are  appropriately  rewarded,  and  senior  officials  are  held 
accountable. 

DOD  Actions:  On  April  9,  2013,  the  Deputy  Secretary  of  Defense  issued 
a  memorandum,  stating  that  most,  if  not  all,  of  DOD’s  executives  have  a 
role  in  its  effort  to  achieve  audit  readiness.  In  the  memorandum,  three 
categories  of  Senior  Executive  Service  (SES)  members  were  described 
and  their  performance  plans  were  to  be  updated  with  objective  and 
measurable  criteria  by  April  30,  2013. 

•  SES  members  in  category  1  are  responsible  for  managing  resources 
or  DOD  business  processes.  The  performance  plans  for  these  SES 
members  are  to  include  an  agency-specific  performance  requirement 
for  business  acumen. 

•  The  second  category  is  those  SES  members  who  have  a  direct  role  in 
their  organizations’  FIAR  efforts.  This  category  includes  headquarters- 
level  financial  managers  with  overall  FIAR  responsibility  as  well  as 
SES  members  in  financial  management  and  other  functional 
communities  (such  as  acquisition,  logistics,  and  personnel)  who 
directly  affect  their  organizations’  financial  records  and  FIAR  efforts. 
These  SES  members  should  include  in  their  performance  plans 
specific  audit-related  goals,  tied  to  their  organizations’  FIPs,  as  an 
agency-specific  performance  requirement  for  being  results  driven. 
Moreover,  to  the  extent  that  these  SES  members  manage  resources 
or  DOD  business  processes,  the  executive  performance  plans  should 
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also  include  the  business  acumen  element  described  in  the  first 
category.  In  assessing  performance  for  this  element,  rating  officials 
are  instructed  to  consider  both  the  individual’s  and  the  organization’s 
results. 

.  The  third  category  consists  of  SES  members  who  do  not  manage 
resources  or  DOD  processes,  who  do  not  have  a  direct  role  in  their 
organizations’  audit  readiness  efforts,  or  both.  According  to  the  April 
9,  2013,  memorandum,  these  SES  members  are  to  request  a  waiver 
from  having  FIAR  goals  included  in  their  executive  performance  plans. 
However,  according  to  an  April  19,  2013,  memorandum,  the  instance 
of  SES  members  falling  into  the  third  category  should  be  rare. 

With  regard  to  the  second  part  of  this  recommendation,  DOD  officials  told 
us  in  December  2014  that  officials  were  considering  bonuses  to  award 
performance  on  the  FIAR-related  goals,  but  had  not  determined  how  to 
reward  executives  with  bonuses  based  on  evaluated  performance  for 
DOD-wide  goals,  such  as  the  FIAR-related  goals.  With  regard  to  part  3  of 
the  panel’s  recommendation,  DOD  officials  stated  that  when  the  FIAR- 
related  goals  were  first  included  in  the  SES  performance  plans,  there  was 
a  perceived  change  in  that  leaders  focused  more  attention  on  FIAR  goals 
and  efforts.  However,  DOD  officials  stated  that  it  is  difficult  to  determine 
the  causality  between  the  inclusion  of  the  FIAR-related  goals  and 
achievement  of  these  goals. 

GAO  Status:  We  consider  this  recommendation  partially  met  because, 
although  DOD  components  have  inserted  FIAR-related  requirements  in 
SES  performance  plans,  additional  actions  are  needed  to  determine  how 
to  reward  executives  based  on  evaluated  performance  for  FIAR-related 
goals  and  to  assess  the  effect  of  these  requirements  on  accomplishing 
FIAR  activities  by  tracking  evaluated  performances  over  several  fiscal 
years.  Without  evaluating  SES  member  performance  relating  to  the  FIAR 
goals,  DOD  only  has  anecdotal  evidence  on  the  effect  of  the  inclusion  of 
these  goals. 


Panel  recommendation  2.2 

To  improve  oversight  of  the  FIAR  effort,  the  Department  should  require  each  DOD 
component  senior  executive  committee  to  review  its  corresponding  component’s  audit 
readiness  assertion  packages  for  compiiance  with  the  FIAR  Guidance  prior  to 
submission  of  those  packages  to  the  Office  of  the  USD(C)  for  validation. 

GAO  status:  Partiaiiy  met 
DOD  status:  Met 

Sources:  House  Armed  Services  Committee  Panel  on  Defense  Rnandal  Management  and  Auditability  Reform,  Findings  and 
Recommendations  (Washington,  D  C.:  Jan.  24,2012);  Department  of  Defense  (FIAR  Plan  Status  Report  May  2015);  and  GAO 
(analysis).  |  GAO-15.463 
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Background:  The  panel  based  this  recommendation  on  the  fact  that 
while  DOD  components  had  senior  executive  committees  to  oversee 
financial  improvements  efforts,  their  oversight  responsibilities  were  not 
effectively  being  carried  out,  as  demonstrated  by  the  ineffective 
implementation  of  FIPs  and  insufficient  evidence  to  support  conclusions 
of  audit  readiness.  In  its  report,  the  panel  stated  that  effective  oversight 
mechanisms  must  be  implemented  to  ensure  that  DOD’s  components  are 
complying  with  FIAR  Guidance. 

DOD  Actions:  As  shown  in  the  May  2015  FIAR  Plan  Status  Report,  DOD 
officials  determined  this  recommendation  to  be  met  because  the  FIAR 
Guidance  requires  that  audit  readiness  management  assertions  be 
signed  by  the  individual  representing  the  organization  responsible  for  the 
subject  matter  and  that  this  level  of  review  and  approval  is  appropriate. 

By  signing  the  audit  readiness  assertion  letter  for  an  assessable  unit  or 
line  item,  the  responsible  individual  is  asserting  that  the  component  has 
followed  the  FIAR  Guidance  to  (1)  document  and  evaluate  internal 
controls  and  (2)  define,  assemble,  and  retain  key  supporting 
documentation  to  support  transactions.  In  addition,  the  individual  is  also 
asserting  that  the  supporting  documentation  can  be  retrieved  and 
provided  within  a  reasonable  period  of  time  to  an  IPAfirm  conducting  an 
examination  or  subsequent  audit.  According  to  DOD  officials,  the 
department  adopted  an  alternative  action  in  response  to  the  panel’s 
recommendation — the  assignment  of  a  functional  lead  to  review  the  audit 
assertion  package.^®  While  the  functional  leads  do  not  sign  off  on  the 
assertion  packages,  these  leads  do  participate  in  the  review  process  for 
the  package.  According  to  DOD  officials,  this  alternative  action 
demonstrates  accountability  and  has  addressed  the  intent  of  the  panel’s 
recommendation. 

GAO  Status:  We  consider  this  recommendation  partially  met  because 
DOD’s  FIAR  Guidance  does  not  require  senior  executive  committee 
reviews  of  audit  assertion  packages  for  compliance  with  the  FIAR 
Guidance  as  the  panel  recommended.  DOD  has  taken  alternative  actions 
of  having  functional  leads  review  audit  assertion  packages  and  individuals 
responsible  for  the  subject  matter  review  and  approve  the  assertion 
packages.  However,  recent  GAO  reports  have  identified  instances  in 


^®Functional  leads  in  this  context  generally  are  officials  outside  the  financial  management 
functional  community. 
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which  the  Army  and  DFAS  have  not  completed  tasks  required  by  the 
FIAR  Guidance,  which  could  result  in  premature  assertions  of  audit 
readiness.^  For  example,  we  found  that  DFAS  had  asserted  audit 
readiness  for  its  contract  pay  assessable  unit  even  though  a  deal-breaker 
was  present.  As  we  reported  in  June  2014,  DFAS  had  not  established  a 
general  ledger  reconciliation  process  at  the  time  it  implemented  its 
contract  pay  FIP.“  Therefore,  we  concluded  that  as  a  result  of  the  lack  of 
a  general  ledger  reconciliation  process,  additional  errors  may  exist  in  the 
recorded  transactions  activity  and  balances  for  DFAS  contract  pay.  If 
DOD  were  to  take  additional  actions  and  require  senior  executive 
committee  reviews  of  the  assertion  packages,  as  recommended  by  the 
panel,  then  the  committee  could  make  a  collective  decision  and  take 
responsibility  for  moving  forward  with  an  assertion,  even  though  a  deal- 
breaker  exists,  rather  than  an  individual  or  functional  lead  making  that 
decision  alone.  Similarly,  the  panel  cited  insufficient  support  for 
conclusions  of  audit  readiness  in  its  report,  reinforcing  the  need  for  higher 
levels  of  review  of  the  audit  readiness  assertion  packages. 


Panel  recommendation  2.3 

The  Department  should  develop  comprehensive  corrective  action  plans  to  address 
existing  material  weaknesses  and  those  Identified  during  the  FIAR  effort. 

GAO  status:  Partially  met 
DOD  status:  Partially  met 

Sources:  House  Armed  Services  Committee  Panel  on  Defense  Rnandal  Management  and  Auditability  Reform,  Findings  and 
Recommendiafions  (Washington,  O.C.:  Jan.  24, 2012);  Department  of  Defense  (FIAR  Plan  Status  Report,  May  2015);  and  GAO 
(analysis).  |  GAO-15-463 


Background:  In  its  report,  the  panel  stated  that  since  the  mid-1990s,  the 
DOD  IG  has  reported  numerous  material  weaknesses  in  internal  control 
that  affect  the  department’s  ability  to  obtain  a  clean  opinion  on  its  financial 


^^GAO,  DOD  Financial  Management:  Improvements  Needed  in  Army’s  Efforts  to  Ensure 
the  Reliability  of  Its  Statement  of  Budgetary  Resources,  GAO-14-60  (Washington,  D.C.: 
May  30,  2014),  and  DOD  Financial  Management:  The  Defense  Finance  and  Accounting 
Service  Needs  to  Fully  Implement  Financial  Improvements  for  Contract  Pay,  GAO-1 4-10 
(Washington,  D.C.:  June  23,  2014). 

^GAO-14-10. 
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statements.^''  In  its  audit  report  for  fiscal  year  2014,  the  DOD  IG  reported 
previously  identified  material  weaknesses^^  in  the  following  areas: 

(I)  Financial  Management  Systems;  (2)  Fund  Balance  with  Treasury; 

(3)  Accounts  Receivable;  (4)  Inventory;  (5)  Operating  Materials  and 
Supplies;  (6)  General  Property,  Plant  and  Equipment;  (7)  Government 
Property  in  Possession  of  Contractors;  (8)  Accounts  Payable; 

(9)  Environmental  Liabilities;  (10)  Statement  of  Net  Cost; 

(II)  Intragovernmental  Eliminations;  (12)  Other  Accounting  Entries;  and 
(13)  Reconciliation  of  Net  Cost  of  Operations  to  Budget.  Many  of  these 
material  weaknesses  are  so  serious  that  they  contribute  to  GAO  being 
unable  to  render  an  opinion  on  the  U.S.  government’s  consolidated 
financial  statements. 

DOD  Actions:  According  to  DOD  officials,  components  that  undergo 
examinations  or  audits  are  required  to  develop  and  implement  CAPs.  The 
13  material  weaknesses  identified  by  the  DOD  IG,  as  well  as  those  self- 
reported  by  the  department,  will  be  addressed  by  specific  reporting  entity 
corrective  actions,  DOD-wide  corrective  actions,  or  DOD-wide  policy 
initiatives  that  are  carried  out  at  the  reporting  entity  level.  Specific 
reporting  entity-level  corrective  action  timelines  are  included  in  the  May 
2015  FIAR  Plan  Status  Report  and  the  April  2015  FIAR  Guidance.  In 
addition,  details  on  DOD-wide  solutions  and  policy  initiatives  are  included 
in  the  May  2015  FIAR  Plan  Status  Report.  With  regard  to  material 
weaknesses  identified  through  the  FIAR  effort,  the  FIAR  Directorate, 
using  its  notices  of  findings  and  recommendations  tracking  database,  is 
monitoring  the  implementation  of  corrective  actions. 


According  to  the  American  Institute  of  Certified  Public  Accountants’  Forming  an  Opinion 
and  Reporting  on  Financiai  Statements  (AU-C  Section  700),  effective  for  audits  of  financial 
statements  for  periods  ending  on  or  after  December  15,  2012,  an  unmodified  opinion 
states  that  the  financial  statements  are  presented  fairly,  in  all  material  respects,  in 
accordance  with  the  applicable  accounting  principles.  For  periods  ending  before 
December  15,  2012,  an  unmodified  opinion  was  known  as  an  unqualified  opinion. 

^^A  material  weakness  is  a  deficiency,  or  combination  of  deficiencies,  in  internal  control 
over  financial  reporting,  such  that  there  is  a  reasonable  possibility  that  a  material 
misstatement  of  the  entity’s  financial  statements  will  not  be  prevented,  or  detected  and 
corrected,  on  a  timely  basis.  A  deficiency  in  internal  control  exists  when  the  design  or 
operation  of  a  control  does  not  allow  management  or  employees,  in  the  normal  course  of 
performing  their  assigned  functions,  to  prevent,  or  detect  and  correct,  misstatements  on  a 
timely  basis. 

■^■^GAO,  Financiai  Audit:  U.S.  Government’s  Fiscat  Years  2014  and  2013  Consoiidated 
Financiai  Statements,  GAO-1 5-341 R  (Washington,  D.C.:  Feb.  26,  2015). 
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GAO  Status:  DOD  has  taken  actions  to  develop  CAPs  at  the  component 
level.  However,  we  consider  this  recommendation  partially  met  because 
DOD  needs  to  take  additional  actions  to  develop  comprehensive  CAPs 
for  addressing  material  weaknesses  at  the  department  level.  According  to 
the  United  States  Chief  Financial  Officers  Council’s  Implementation  Guide 
for  0MB  Circular  A-1 23,  a  comprehensive  CAP  lists  the  detailed  actions 
that  must  be  taken  to  resolve  the  weakness  or  deficiency,  including 

(1 )  summary  description  of  the  deficiency  and  year  first  identified; 

(2)  targeted  corrective  action  date  (the  date  for  management  follow-up); 

(3)  agency  official  responsible  for  monitoring  progress;  (4)  indicators, 
statistics,  or  metrics  used  to  measure  progress  in  resolving  the  weakness 
or  deficiency;  and  (5)  milestone  or  other  characteristic  used  to  report  how 
resolution  activities  are  progressing.^  Given  the  critical  nature  of  the 
long-standing,  material  weaknesses  in  internal  control  reported  for  fiscal 
year  2014,  their  resolution  will  require  a  concerted  effort  by  leadership  at 
the  component  level  to  implement  corrective  actions  with  oversight  from 
the  Office  of  the  Under  Secretary  of  Defense  (Comptroller),  to  monitor 
department-wide  initiatives  and  implement  component-level  CAPs.^® 

DOD,  to  meet  this  recommendation,  will  also  need  to  monitor  the 
development  and  implementation  of  corrective  actions  for  weaknesses 
identified  from  FIAR-related  activities,  such  as  audits  and  examinations, 
to  ensure  that  comprehensive  CAPs  are  developed  and  these 
weaknesses  are  fully  addressed  at  both  the  component  and  department 
levels. 


Panel  recommendation  2.4 

To  reduce  improper  payments,  the  Department  should  re-evaluate  its  methodology 
for  identifying  and  reporting  improper  payments. 

GAO  status:  Partially  met 
DOD  status:  Partially  met 

Sources:  House  Armed  Services  Committee  Panel  on  Defense  Rnandal  Management  and  Auditability  Reform,  Findings  and 
Recommendations  (Washington,  D  C.:  Jan.  24. 2012);  D^>artm^t  of  Defense  (FIAR  Plan  Status  Report,  May  2015);  and  GAO 
(analysis).  |  GAO-15-463 


^Chief  Financial  Officers  Council,  Implementation  Guide  for  0MB  Circular  A-1 23, 
Management’s  Responsibility  for  Internal  Control  Appendix  A,  Internal  Control  over 
Financial  Reporting  (Washington,  D.C.:  July  2005).  The  guide  is  intended  to  assist  federal 
managers  with  implementing  a  process  for  assessing  the  effectiveness  of  an  entity’s 
internal  control  over  financial  reporting. 

^^Department  of  Defense,  United  States  Department  of  Defense  Agency  Financial  Report 
Fiscal  Year  2014  (Washington,  D.C.:  November  2014). 
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Background:  The  panel  based  this  recommendation  on  GAO’s  findings 
included  in  a  July  2009  report  that  reported  DOD  may  not  be  capturing 
the  full  extent  of  its  improper  payments.^®  Specifically,  we  found  in  2009 
that  DOD  had  not  conducted  risk  assessments  for  all  of  its  payment 
activities  and  $322  billion  in  outlays  were  excluded  from  the  amounts 
assessed.  In  addition,  at  that  time  we  stated  that  DOD  had  not  estimated 
improper  payments  for  commercial  pay,  its  largest  payment  activity,  in 
accordance  with  improper  payment  requirements.®^  The  then-DOD 
Comptroller  testified  before  the  panel  that  DOD  is  taking  steps,  based  on 
the  Improper  Payments  Elimination  and  Recovery  Act  of  201 0,®®  to  initiate 
a  statistical  sampling  program  for  commercial  payments.®®  In  its  report, 
the  panel  acknowledged  DOD’s  efforts  to  initiate  statistical  sampling  for 
commercial  payments  but  recommended  that  DOD  take  further  action  to 
address  this  issue. 

DOD  Actions:  In  its  May  2015  FIAR  Plan  Status  Report,  DOD  officials 
stated  that  the  department  continues  to  review  its  sampling 
methodologies  for  all  payment  types  to  ensure  that  it  can  properly 
estimate  improper  payment  dollars.  For  example,  DFAS  reevaluated  and 
enhanced  its  statistical  sampling  methodology  for  DFAS  commercial 
payments  for  fiscal  year  2014  improper  payment  reporting.  Also,  for  fiscal 
year  2014,  the  Defense  Health  Agency  modified  its  TRICARE  improper 


®®GAO,  Improper  Payments:  Significant  Improvements  Needed  in  DOD’s  Efforts  to 
Address  Improper  Payment  and  Recovery  Auditing  Requirements,  GAO-09-442 
(Washington,  D.C.:  July  29,  2009). 

®^DOD’s  commercial  pay  includes  both  contract  and  vendor  payments.  Contract  payments 
include  disbursements  for  complex,  multiyear  purchases  with  high  dollar  amounts,  such  as 
weapon  systems.  Vendor  payments  include  purchases  for  day-to-day  goods  and  services, 
such  as  food,  fuel,  and  transportation.  DOD’s  improper  payment  programs  relating  to 
commercial  pay  include  DFAS  commercial  pay  (the  largest  of  all  DOD  payment 
programs).  Navy  payments  made  from  its  ERP,  and  U.S.  Army  Corps  of  Engineers 
commercial  pay. 

®®Pub.  L  No.  111-204,  124  Stat.  2224  (July  22,  2010). 

®®Robert  F.  Flale,  Under  Secretary  of  Defense  (Comptroller)/Chief  Financial  Officer, 
Department  of  Defense,  Oversight:  Assessing  Efforts  to  Eliminate  Improper  Payments, 
testimony  before  the  Senate  Committee  on  Flomeland  Security  and  Governmental  Affairs, 
Subcommittee  on  Federal  Financial  Management,  Government  Information,  Federal 
Services,  and  International  Security,  112th  Cong.,  Istsess.,  May  25,  2011. 
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payment  calculation  formula  in  response  to  our  prior  findings/”  DOD 
stated  that  the  department  will  be  reviewing  the  sampling  methodologies 
for  the  other  seven  programs  for  which  improper  payment  estimates  are 
reported  in  its  agency  financial  report.  However,  DOD  stated  in  its  fiscal 
year  2014  agency  financial  report  that  it  cannot  demonstrate  that  all 
payments  subject  to  improper  payment  requirements  were  included  in  the 
population  of  payments  to  review.'^'' 

GAO  Status:  DOD  has  taken  some  steps  to  improve  its  improper 
payment  sampling  methodologies  for  some  programs,  but  we  consider 
this  recommendation  partially  met  because  DOD  still  needs  to  reevaluate 
its  methodology  for  identifying  and  reporting  improper  payments  for  other 
types  of  programs.  In  addition,  DOD  cannot  demonstrate  that  the 
payments  subject  to  improper  payment  estimation  that  are  included  in  the 
populations  from  which  the  samples  are  selected  are  complete,  accurate, 
and  valid.  As  we  stated  in  May  2013,  the  foundation  of  reliable  statistical 
sampling  estimates  is  a  complete,  accurate,  and  valid  population  from 
which  to  sample.'*^  Furthermore,  we  stated  that  DOD  did  not  maintain  the 
supporting  documentation  needed  to  substantiate  reported  improper 
payment  estimates. 


^°The  Defense  Health  Agency  is  the  DOD  agency  responsible  for  administering  the 
military  health  program  known  as  TRICARE.  In  May  2013,  we  reported  a  calculation  error 
in  the  military  health  benefits  improper  payment  estimate.  Specifically,  DOD  used  an 
improper  denominator  to  calculate  the  improper  payment  rate  for  its  sample.  Instead  of 
dividing  the  dollar  amount  of  identified  improper  payments  in  the  sample  by  the  dollar 
amount  paid  to  providers,  which  would  provide  a  percentage  of  improper  payments,  DOD 
divided  the  dollar  amount  of  identified  improper  payments  by  the  dollar  amount  billed  by 
providers  for  the  services  rendered. 

Department  of  Defense,  United  States  Department  of  Defense  Agency  Financial  Report 
Fiscal  Year  2014  (Washington,  D.C.:  November  2014). 

"*^GAO,  DOD  Financial  Management:  Significant  Improvements  Needed  in  Efforts  to 
Address  Improper  Payment  Requirements,  GAO-13-227  (Washington,  D.C.:  May  13, 
2013). 
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Panel  recommendation  2.5 

To  reduce  Antideficiency  Act  (ADA)  violations,  the  Department  should  (1 )  perform  an 
analysis  of  the  causes  for  its  ADA  violations  and  then  develop  and  implement 
procedures  to  address  identified  causes  and  (2)  ensure  that  key  funds  control  personnel 
are  adequately  trained  to  prevent,  detect,  and  report  ADA  violations. 

GAO  status:  Met 
DOD  status:  Met 

Sources:  House  Amied  Services  Committee  Panel  on  Defertse  Rnandal  Management  and  Auditability  Reform,  Findings  and 
Recommendafions  (Washington,  D  C.:  Jan.  24, 2012);  Department  of  Defense  (FIAR  Plan  Status  Report  May  2015);  and  GAO 
(analysis).  |  GAO-15463 


Background:  In  its  report,  the  panel  noted  that  DOD’s  poor  internal 
controls  put  it  at  risk  of  violating  the  Antideficiency  Act  (ADA),  referring  to 
DOD  IG  and  GAO  testimonies.'*^  The  Deputy  IG  for  Auditing  testified  that 
DOD’s  control  environment  weaknesses  impaired  its  ability  to  determine 
the  amount  of  funds  that  it  had  available  to  spend,  and  as  a  result,  DOD 
was  at  risk  of  overobligating  and  overexpending  its  appropriations  and 
violating  the  ADA.'*'*  He  added  that  a  lack  of  adequate  controls  and 
training  contributed  to  potential  ADA  violations.  In  201 1,  we  testified  that 
because  the  ADA  prohibits,  and  effective  funds  control  should  prevent, 
overobligations  and  overexpenditures  of  public  funds,  the  number  and 
dollar  amount  of  ADA  violations  were  indicators  of  the  status  of  DOD’s 
funds  control.'*®  In  our  testimony,  we  stated  that  DOD  had  issued  and 
periodically  updated  policies  that  addressed  responsibilities  for  preventing 
and  identifying  ADA  violations.  In  addition,  we  testified  that  DOD’s 
guidance  described  frequent  causes  of  ADA  violations  within  the 
department  and  explained  the  actions  necessary  to  avoid  them,  including 
(1)  emphasizing  management  and  supervisory  duties,  (2)  training  of  key 
funds  control  personnel,  and  (3)  effective  systems  and  procedures. 


'*^31  U.S.C.  §§  1341-42,  1349-52,  1511-19. 

'*'*Daniel  Blair,  Deputy  Inspector  General  for  Auditing,  Department  of  Defense  Office  of 
inspector  Generai,  DOD’s  Efforts  to  Improve  Payment  and  Funds  Control,  testimony 
before  the  House  Committee  on  Armed  Services,  Panel  on  Defense  Financial 
Management  and  Auditability  Reform,  112th  Cong.,  1st  sess.,  September  22,  2011. 

'*®GAO,  DOD  Financial  Management:  Weaknesses  in  Controls  over  the  Use  of  Public 
Funds  and  Related  Improper  Payments,  GAO-1 1-950T  (Washington,  D.C.;  Sept.  22, 
2011). 
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DOD  Actions:  In  its  Financial  Management  Regulation  (FMR),  DOD 
includes  the  causes  of  ADA  violations  it  has  identified"^®  as  well  as  the 
department’s  policies  and  procedures  to  prevent  these  violations. With 
respect  to  ensuring  that  key  funds  control  personnel  are  adequately 
trained,  DOD  officials,  in  a  memorandum  dated  December  13,  2011, 
stated  that  beginning  October  1 , 2012,  the  frequency  of  training  for  ADA 
investigators  will  change  from  5-year  to  3-year  intervals."^®  According  to 
the  May  2015  revised  chapter  of  DOD’s  FMR  on  administrative  control  of 
funds, the  components  are  required  to  submit  a  memorandum  on  their 
annual  evaluation  of  overall  administrative  control  processes  and  ADA 
violations.  This  memorandum  is  to  include  a  statement  that  provides  the 
number  of  key  funds  control  personnel  identified  and  trained  as 
prescribed  in  the  FMR.  In  the  May  2015  FIAR  Plan  Status  Report,  DOD 
officials  stated  that  the  military  departments  and  components  are  required 
to  review  and  evaluate  training  records  to  ensure  that  personnel  certifying 
and  handling  funds  have  financial  management  and  fiscal  law  training.  In 
addition  to  increasing  the  frequency  of  training  for  ADA  investigators, 

DOD  has  implemented  its  Financial  Management  Certification  Program, 
which  includes  training  on  fiscal  law.  This  training  on  fiscal  law  covers 
funds  control  and  ADA  requirements. 

GAO  Status:  We  believe  DOD’s  actions  have  met  the  requirements  of 
the  recommendation. 


"^®DOD  categorizes  violations  of  various  fiscal  laws  and  violations  of  the  ADA,  such  as 
authorizing  expenditures  in  excess  of  appropriations,  collectively,  as  ADA  violations. 

"^^DOD’s  regulations  carrying  out  this  requirement  are  in  the  DOD  Financial  Management 
Regulation  (FMR),  7000. 14R,  vol.  14,  ch.  1,  “Administrative  Control  of  Funds”  (January 
2009).  DOD’s  FMR  is  issued  under  the  authority  of  DOD  Instruction  7000.14,  Department 
of  Defense  Financial  Management  Policy  and  Procedures  (rev.  Sept.  17,  2008).  The  DOD 
FMR  directs  statutory  and  regulatory  financial  management  requirements,  systems,  and 
functions  for  all  appropriated  and  nonappropriated  working  capital,  revolving,  and  trust 
fund  activities. 

4ft 

Department  of  Defense,  Office  of  the  Under  Secretary  of  Defense  (Comptroller), 
Antideficiency  Act  (ADA)  Investigator  Training  Frequency  {\Nash\ngton,  D.C.:  Dec.  13, 
2011). 

"^®DOD  Financial  Management  Regulation  (FMR),  7000. 14R,  vol.  14,  ch.  2,  “Antideficiency 
Act  Violations”  (May  2015). 
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Panel  recommendation  2.6 

To  reduce  problem  disbursements,  the  Department  should  address  the  underlying 
causes  of  problem  disbursements  in  its  efforts  to  develop  and  implement  enterprise 
resource  planning  (ERP)  systems. 

GAO  status:  Partially  met 
DOD  status:  Partially  met 

Sources:  House  Anned  Services  Committee  Panel  on  Defense  Rnandal  Management  and  Auditability  Reform,  Findings  and 
Recommendations  (Washington,  D.C.:  Jan.  24, 2012);  Department  of  Defense  (FIAR  Plan  Status  Report  May  201 5);  and  (5AO 
(analysis).  |  GAO-15-463 

Background:  Problem  disbursements  include  both  unmatched 
disbursements  and  negative  unliquidated  obligations.  Unmatched 
disbursements  are  disbursements  that  have  been  paid  by  an  accounting 
office  but  have  not  been  matched  to  the  correct  obligation  records.  A 
negative  unliquidated  obligation  is  a  disbursement  transaction  that  has 
been  matched  to  an  obligation,  but  the  total  recorded  disbursement 
exceeds  the  recorded  obligation.  In  its  report,  the  panel  stated  that 
problem  disbursements  impede  DOD’s  performance  of  proper  Fund 
Balance  with  Treasury  reconciliations, “  which  affects  DOD’s  ability  to 
report  reliable  information  on  its  financial  statements.®^ 

DOD  Actions:  DOD’s  Deputy  Chief  Financial  Officer  testified  that 
problem  disbursements  are  caused  by  errors  or  deficiencies  that  have 
occurred  during  the  procure-to-pay  process.®^  According  to  DOD  officials, 
problem  disbursements  can  occur  when  the  disbursing  function  is 
separated  from  the  entitlement  and  accounting  processes.  DOD  officials 
stated  that  the  implementation  of  modern  financial  systems,  including 
ERP  systems,  has  temporarily  increased  the  level  of  problem 


®°ln  the  federal  government,  an  agency’s  Fund  Balance  with  Treasury  accounts  are 
similar  in  concept  to  corporate  bank  accounts.  The  difference  is  that  instead  of  a  cash 
balance.  Fund  Balance  with  Treasury  represents  unexpended  spending  authority  in 
appropriation  accounts.  Similar  to  bank  accounts,  the  funds  in  DOD’s  appropriation 
accounts  must  be  reduced  or  increased  as  the  department  spends  money  or  receives 
collections  that  it  is  authorized  to  retain  for  its  own  use. 

®’dod,  in  its  November  201 3  FIAR  Plan  Status  Report,  stated  that  because  of  the  strong 
relationship  between  the  Fund  Balance  with  Treasury  line  item  on  the  Balance  Sheet  and 
line  items  on  the  SBR,  DOD’s  strategy  for  achieving  successful  completion  of  Wave  2 
depends  on  achieving  an  auditable  Fund  Balance  with  Treasury  balance. 

®^Mark  Easton,  Deputy  Chief  Financial  Officer,  Department  of  Defense,  DOD’s  Efforts  to 
Improve  Payment  and  Funds  Control,  testimony  before  the  House  Committee  on  Armed 
Services,  Panel  on  Defense  Financial  Management  and  Auditability  Refonn,  112th  Cong., 
1  St  sess.,  September  22,  2011. 
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disbursements  because  of  data  quality  issues  and  the  need  for  interfaces 
with  legacy  systems  that  are  still  in  use.  However,  the  officials  stated  that 
by  the  time  the  ERP  systems  mature  and  their  operations  become  stable, 
the  data  quality  issues  should  be  resolved.  Moreover,  DOD  officials 
stated  that  these  ERP  systems  should  provide  an  automated,  integrated 
environment  that  will  significantly  reduce  the  number  of  problem 
disbursements.  DOD  officials  also  stated  that  the  auditors’  notices  of 
findings  and  recommendations  from  examinations  and  audits  should  help 
in  resolving  issues  causing  problem  disbursements.  In  its  May  2015  FIAR 
Plan  Status  Report,  DOD  officials  stated  that  analyses  will  be  performed 
on  a  recurring  basis  until  the  department  is  able  to  retire  ail  legacy 
systems  and  fully  implement  ERP  capabilities.  DOD  officials  added  that 
these  analyses  and  reconciliations  should  assist  in  identifying  root  causes 
of  problem  disbursements  and  implementing  corrective  actions. 

GAO  Status:  We  consider  this  recommendation  partially  met  because 
DOD  needs  to  continue  to  address  the  underlying  causes  of  problem 
disbursements  as  it  develops  and  implements  ERP  systems. 


Panel  recommendation  2.7 

The  Department  should  identify  and  institutionalize  best  practices,  as  applicable, 
throughout  the  DOD  to  reinforce  the  full  engagement  of  those  functional  communities 
outside  of  the  financial  management  community  in  audit  readiness  efforts. 

GAO  status:  Partially  met 
DOD  status:  Partially  met 

Sources:  House  Armed  Services  Committee  Panel  on  Defense  Rnandal  Management  and  Auditability  Reform.  Findings  and 
Recommendadons  (Washington.  D.C.:  Jan.  24. 2012);  Department  of  Defense  (FIAR  Plan  Status  Report  May  2015);  and  C3AO 
(analysis).  |  GAO-15-463 


Background:  In  its  report,  the  panel  stated  that  it  was  encouraged  by  the 
testimony  of  DOD  logistics  community  representatives  about  their  role  in 
efforts  to  improve  financial  management  and  achieve  audit  readiness. 
However,  the  panel  stated  that  engaging  the  functional  communities  in 
the  audit  readiness  effort  must  continue  to  be  prioritized. “  The  panel,  in 
its  report,  referred  to  the  Air  Force’s  testimony  in  which  the  Director  of 
Logistics  stated  that  one  of  the  biggest  challenges  is  ensuring  that  the 


^^DOD  defines  a  functional  community  as  employees  who  perform  similar  functions. 
Logistics  and  financial  management  are  2  of  22  DOD  functional  communities. 
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logistics  and  acquisition  functional  communities  understand  their  role  in 
achieving  audit  readiness.®'^ 

DOD  Actions:  DOD  officials  stated,  in  the  May  2015  FIAR  Plan  Status 
Report,  that  the  Office  of  the  Under  Secretary  of  Defense  (Comptroller), 
through  the  FIAR  governance  process,  is  aware  of  solutions  and  best 
practices  identified  and  implemented  by  DOD’s  components,  including 
those  identified  by  the  functional  communities.  As  cited  in  the  report, 
some  of  the  best  practices  shared  among  the  components,  including  the 
functional  leads  serving  on  the  FIAR  effort,  are  as  follows: 

•  Solution  to  be  used  by  the  military  departments  for  valuing  existing 
real  property  assets  (deflated  plant  replacement  value).®® 

•  Army  use  of  an  Air  Force  environmental  liability  cost  estimation  tool. 

•  Army  and  Air  Force  use  of  an  audit  response  tool  developed  by  the 
Navy. 

•  Navy  use  of  a  Fund  Balance  with  Treasury  reconciliation  tool 
developed  by  the  Air  Force. 

GAO  Status:  We  consider  this  recommendation  partially  met  because 
the  FIAR  Directorate  needs  to  take  additional  actions  to  validate  whether 
identified  best  practices  have  been  institutionalized  department-wide.  In 
addition,  DOD  did  not  comprehensively  document  lessons  learned  and 
best  practices,  and  therefore  the  department  is  missing  an  opportunity  to 
gain  institutional  knowledge  that  would  facilitate  future  decision  making. 
Federal  internal  control  standards  highlight  the  importance  of 


®^Major  General  Judith  Fedder,  Director  of  Logistics,  Department  of  the  Air  Force,  The 
Organizational  Challenges  in  Achieving  Sound  Financial  Management  and  Audit 
Readiness,  testimony  before  the  Flouse  Committee  on  Armed  Services,  Panel  on  Defense 
Financial  Management  and  Auditability  Reform,  11 2th  Cong.,  1st  session.  Sept.  15,  201 1. 

®®For  some  property,  plant  and  equipment,  agencies  may  decide  to  continue  to  use  the 
property  even  though  there  is  diminished  service  utility.  Plant  replacement  value  is  an 
estimated  cost  to  replace  a  building  in  current  dollars.  For  example,  for  federal  real 
property  purposes,  plant  replacement  value  can  be  used  to  calculate  estimated  utility  loss 
when  an  agency  decides  to  accept  the  reduced  performance  objectives  of  a  building 
rather  than  make  major  repairs  and  costly  upgrades.  This  approach  uses  the  plant 
replacement  value  to  determine  the  portion  of  historical  cost  that  should  be  written  off. 
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documenting  significant  events  in  a  timely  manner.^  Specifically,  these 
standards  state  that  agencies  should  identify,  record,  and  distribute 
pertinent  information  to  the  right  people  in  sufficient  detail,  in  the  right 
form,  and  at  the  appropriate  time  to  enable  them  to  carry  out  their  duties 
and  responsibilities  and  ensure  that  communications  are  relevant, 
reliable,  and  timely.  Institutionalizing  identified  best  practices  in  writing 
may  assist  in  consistent  application  and  fully  engaging  functional 
communities  outside  of  the  financial  management  community  in  audit 
readiness  efforts,  as  necessary. 


Panel  recommendation  2.8 

The  Department  should  develop  a  forum  in  which  the  miiitary  commands  can  share 
iessons  iearned  from  their  respective  audit  readiness  efforts. 

GAO  status:  Met 
DOD  status:  Met 

Sources:  House  Armed  Services  Committee  Panel  on  Defense  Rnandal  Management  and  Auditability  Reforni,  Findings  and 
Recommenoiations  (Washington.  D.C.:  Jan.  24, 2012);  Department  of  Defense  (FIAR  Plan  Status  Report,  May  2015);  and  GAO 
(analysis).  |  (3AO-1 5-463 


Background:  In  its  report,  the  panel  recognized  that  the  majority  of 
transactions  recorded  in  accounting  systems  are  initiated  by  military 
commands,  installations,  and  bases.  Based  on  this,  the  panel  stated  that 
for  DOD  to  achieve  its  FIAR  objectives,  internal  controls  over,  and  the 
accounting  of,  these  transactions  must  be  improved  at  these  locations. 
Based  on  testimony  from  the  Commander  of  the  Naval  Air  Systems 
Command,  the  panel  stated  that  the  lessons  learned  at  Naval  Air 
Systems  Command  should  be  shared  with  other  military  commands  and 
vice  versa. 

DOD  Actions:  In  its  May  2015  FIAR  Plan  Status  Report,  DOD  officials 
stated  that  the  military  departments  and  defense  agencies  regularly  share 
lessons  learned  within  their  organizations  in  various  forums,  such  as 
newsletters,  quarterly  reviews,  and  stakeholder  meetings.  The  FIAR 
Subcommittee,  FIAR  Committee,  and  FIAR  Governance  Board  meetings 


^GAO,  Standards  for  Internal  Control  in  the  Federal  Government,  GAO/AIMD-00-21.3.1 
(Washington,  D.C.:  November  1999). 

^^Vice  Admiral  David  Architzel,  Commander,  Naval  Air  Systems  Command, 

Organizational  Challenges  in  Achieving  Sound  Financial  Management  and  Audit 
Readiness,  testimony  before  the  House  Committee  on  Armed  Services,  Panel  on  Defense 
Financial  Management  and  Auditability  Reform,  1 12th  Cong.,  1st  sess.,  September  15, 
2011. 
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are  forums  that  are  regularly  used  to  share  information  external  to  an 
individual  DOD  component. 

GAO  Status:  We  believe  DOD’s  actions  have  met  the  requirements  of 
the  recommendation. 


Panel  recommendation  2.9 

The  DOD  Comptroller  should  include  milestones  along  with  the  status  of  DOD  financial 
service  provider  efforts  to  achieve  effective  controls  over  the  major  processes  that  affect 
DOD  customers  in  the  FIAR  Plan  Status  Reports.  These  milestones  should  be  consistent 
with  the  customer  organizations’  audit  readiness  milestones. 

GAO  status:  Partially  met 
DOD  status:  Partially  met 

Sources:  House  ^med  Services  Committee  Panel  on  Defense  Rnandal  Management  and  Auditability  Reform,  Findings  and 
Recommendations  (Washir>gton,  D.C.:  Jan.  24, 2012);  Department  of  Defense  (FIAR  Plai  Status  Report  May  2015);  and  GAO 
(an^ysis).  |  GAO-15-463 


Background:  The  panel  recognized  that  because  DFAS’s  activities  are 
integral  to  the  financial  activities  reported  in  the  DOD  components’ 
financial  statements,  weaknesses  in  internal  control  at  DFAS  must  be 
addressed  for  DOD  to  achieve  auditability.  In  its  report,  the  panel  referred 
to  the  FIAR  Guidance,  which  states  that  service  providers,  such  as  DFAS, 
that  work  with  user  entities  are  responsible  for  audit  readiness  efforts 
surrounding  service  provider  systems  and  data,  processes  and  controls, 
and  supporting  documentation  that  have  a  direct  effect  on  user  entities’ 
auditability.  Therefore,  according  to  the  panel’s  report,  it  is  critical  that 
these  organizations  provide  documentation  demonstrating  that  controls 
are  properly  designed  and  operating  effectively  and  transactions  are 
properly  posted  to  the  accounting  records.  The  panel  stated  that  DFAS 
should  undergo  an  audit  of  its  major  processes  that  materially  affect  its 
users.  In  addition,  timelines  for  establishing  effective  controls  should  be 
reported  in  future  FIAR  Plan  Status  Reports  for  all  major  processes. 

DOD  Actions:  DOD  included  service  providers’  FIAR  status  and 
milestones  in  its  FIAR  Plan  Status  Reports  beginning  with  the  May  2012 
report.  In  the  May  2015  FIAR  Plan  Status  Report,  DOD  officials  stated 
that  in  addition  to  including  service  provider  milestones  in  DOD  reports, 
the  Office  of  the  Under  Secretary  of  Defense  (Comptroller)  and  DOD’s 
components  monitor  service  providers’  milestones,  progress,  and 
challenges  during  service  provider  working  group  meetings,  as  well  as 
during  other  FIAR  oversight  meetings,  such  as  FIAR  Committee 
meetings.  DOD  also  stated,  in  the  May  2015  FIAR  Plan  Status  Report, 
that  integrating  the  audit  readiness  activities  of  the  service  providers  with 
their  customers  is  complex  and  is  one  of  the  challenges  the  department 
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faces  to  achieving  audit  readiness.  One  reason  for  this  complexity  is  that 
the  components  rarely  control  transactions  from  initiation  to  reporting  on 
the  component  financial  statements.  Moreover,  the  components  do  not 
o\vn  and  operate  all  of  the  information  systems  used  to  process  their 
transactions.  One  example  provided  by  the  department  relates  to 
processing  and  recording  contract  pay,  for  which  the  components  depend 
on  over  a  dozen  systems  that  are  owned  and  operated  by  service 
providers. 

GAO  Status:  We  consider  this  recommendation  partially  met  because 
DOD  needs  to  take  additional  actions  to  show  the  comparison  of  the 
service  provider  milestones  with  those  of  their  customers  so  that  the 
consistency  of  the  milestones  between  service  provider  and  customer  can 
be  seen.  Currently,  the  FIAR  Plan  Status  Reports  show  the  service 
providers’  status  and  plans  for  achieving  audit  readiness  and  conducting 
SSAE  No.  16  examinations  by  assessable  unit.®®  Ensuring  that  the 
component  milestones  and  service  provider  milestones  are  consistent  for 
each  process  included  in  the  FIAR  effort  remains  challenging. 


Financial  Management 
Workforce 


Sources:  House  Anned  Services  Committee  Panel  on  Defense  Rnandal  Management  and  Auditability  Reform,  Findings  and 
Recommendations  (Washington,  O.C.:  Jan.  24, 2012);  Department  of  Defense  (FIAR  Plan  Status  Report,  May  2015);  and  GAO 
(analysis).  |  GAO-15-463 


Panel  recommendation  3.1 

The  Department  should  assess  its  financial  management  workforce  and  that  of  all  other 
functional  areas  performing  financial  management-related  functions  regarding:  (1)  critical 
skills  and  competencies  of  the  existing  civilian  employee  workforce;  (2)  critical  skills  and 
competencies  that  may  be  needed  over  the  next  decade;  (3)  gaps  between  current 
requirements  and  existing  workforce  competencies:  and  (4)  gaps  between  projected 
requirements  and  existing  workforce  competencies.  The  assessment  should  include 
federal  civilian,  military,  and  contracted  personnel  performing  financial  management- 
related  functions. 

GAO  status:  Partially  met 
DOD  status:  Partially  met 


Background:  The  panel  reported  that  at  the  time  of  its  review,  DOD  had 
not  yet  performed  a  complete  department-wide  systematic  competency 
assessment  that  included  an  analysis  of  the  financial  management 


®®DOD  service  providers,  upon  completion  of  financial  improvement  work,  undergo 
examinations  in  accordance  with  SSAE  No.  16,  Reporting  on  Controls  at  a  Service 
Organization.  Those  service  providers  that  are  not  required  to  undergo  an  SSAE  No.  16 
examination  must  work  with  components  to  determine  how  they  will  support  audit 
readiness  efforts. 
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workforce  abilities,  knowledge  bases,  and  skill  sets  needed  now  and  in 
the  future.  DOD  developed  and  issued  its  department-wide  (enterprise¬ 
wide)  financial  management  competencies  for  its  civilian  workforce  in 
November  201 1 ,  immediately  preceding  the  panel  report’s  issuance.^®  In 
issuing  these  competencies,  DOD  officials  stated  that  they  identify  the 
critical  knowledge,  skills,  and  abilities  that  DOD  financial  managers  need 
to  meet  the  (1)  complex  21st  century  national  security  mission  and 
(2)  unique  requirements  of  the  department,  including  analysis  and  audit 
readiness. 

DOD  Actions:  DOD  has  taken  steps  toward  completing  a  department¬ 
wide  systematic  competency  assessment  of  its  financial  management 
workforce.  The  department  plans  to  do  a  review  or  “refresh”  of  its 
department-wide  financial  management  competencies  for  its  civilian 
workforce  in  fiscal  year  2016.  With  regard  to  identifying  the  gaps  between 
current  requirements  and  the  competencies  of  the  existing  workforce, 
DOD  has  used  its  Defense  Competency  Assessment  Tool  to  assess 
competency  gaps  in  its  civilian  financial  management  workforce  for  its 
four  civilian  mission-critical  financial  management  occupations  in  2014 
and  its  nine  civilian  non-mission-critical  financial  management 
occupations  in  2015.®°  As  stated  in  the  May  2015  FIAR  Plan  Status 
Report,  DOD  plans  to  research  the  feasibility  of  assessing  the  civilian 
financial  management  workforce  in  other  functional  areas.  The  panel 
recommended  that  DOD’s  competency  assessments  be  performed  for  its 
federal  civilian,  military,  and  contracted  personnel  performing  financial- 
related  functions.  With  regard  to  military  personnel  in  financial 
management  occupations,  DOD  officials  stated  that  its  research  showed 
that  the  military  departments,  through  the  normal  annual  military 
performance  review  process,  have  an  effective  means  of  assessing  the 
competencies  of  members  of  the  military  workforce  in  their  given 
functional  specialties.  Moreover,  DOD  officials  stated  that  assessing  the 
competency  gaps  of  contracted  staff  performing  financial  management- 
related  functions  is  outside  the  financial  management  community’s  scope 


®®Department  of  Defense,  Department  of  Defense  (DOD)  Financial  Management  Civilian 
Enterprise-wide  Compefenc/es  (Washington,  D.C.:  Nov.  16,  2011). 

°°As  we  previously  reported,  the  Defense  Competency  Assessment  Tool  is  an  Army 
system  that  was  updated  for  department-wide  use  to  replace  multiple  competency  tools. 
See  GAO,  Human  Capital:  Critical  Skills  and  Competency  Assessments  Should  Help 
Guide  DOD  Civilian  Workforce  Decisions,  GAO-13-188  (Washington,  D.C.:  Jan.  17, 
2013). 
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of  responsibility  because  required  competencies  are  to  be  defined  in  each 
contract’s  statement  of  work.  In  addition,  the  appropriate  contracting 
officer’s  technical  representative  has  the  responsibility  to  perform  due 
diligence  over  the  contractor’s  performance. 

GAO  Status:  We  consider  this  recommendation  partially  met  because 
the  department  has  not  yet  assessed  the  competencies  of  all  civilian, 
military,  and  contracted  personnel  performing  financial  management- 
related  functions,  as  recommended  by  the  panel.  Furthermore,  the 
Functional  Community  Manager  for  Financial  Management  concluded 
that  there  is  not  a  legislative  requirement  for  a  competency  skills  gap 
assessment  for  the  military  financial  management  workforce.®''  DOD, 
however,  is  required  by  law  to  submit  a  biennial  strategic  workforce 
management  plan  to  Congress,  which  includes,  among  other  things,  an 
assessment  of  the  critical  skills  and  competencies  that  will  be  needed  in 
the  future.®^  According  to  the  law,  this  plan  shall  specifically  address  the 
shaping  and  improvement  of  DOD’s  financial  management  workforce, 
including  military  and  civilian  personnel.  This  includes  an  assessment  of 
the  critical  skills  and  competencies  for  both  the  civilian  and  military 
financial  management  workforces.  As  stated  above,  DOD’s  competency 
assessments  have  only  addressed  the  civilian  workforce  in  the  financial 
management  community.  When  DOD  conducts  its  review  of  the 
department-wide  civilian  financial  management  workforce  competencies 
in  fiscal  year  2016,  the  department  will  need  to  consider  projected  future 
requirements  (competencies)  for  its  civilian  financial  management 
workforce,  as  the  panel  recommended.  After  the  department  has 
identified  the  projected  future  requirements  (competencies),  DOD  will  be 
in  a  position  to  identify  the  gaps  between  the  projected  future 
requirements  for  its  civilian  financial  management  workforce  and  those 
possessed  by  its  existing  workforce. 


®^This  Functional  Community  Manager  for  Financial  Management  position  is  in  the  Office 
of  the  Under  Secretary  of  Defense  (Comptroller).  The  military  departments  have  similar 
positions. 

®210  U.S.C.  §  115b. 
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Panel  recommendation  3.2 

The  Department  should  utilize  the  expertise  of  certified  public  accountants  (CPAs)  with 
financial  statement  audit  experience  in  its  audit  readiness  efforts  as  conducted  by  the 
federal  civilian  workforce  or  contracted  personnel,  as  appropriate. 

GAO  status:  Met 
DOD  status:  Met 

Sources:  House  Armed  Services  Committee  Panel  on  Defense  Financial  Management  and  Auditability  Reform.  Findings  and 
Recomme/xfafions  (Washington.  O.C.:  Jan.  24, 2012);  Department  of  Defense  (FIAR  Plan  Status  Report,  May  2015);  and  GAO 
(analysis).  |  GAO-15-463 

Background:  In  testimony  before  the  panel,  DOD  stated  that  the 
department  uses  contractors  to  fill  skill  sets  missing  from  its  existing 
workforce  in  certain  areas,  including  audit  readiness. “  Industry  officials 
testified  on  the  importance  of  hiring  certified  public  accountants  (CPA) — 
either  directly  or  through  contracts — with  financial  audit  experience.®^ 
According  to  expert  testimony,  although  hiring  CPAs  is  an  important 
aspect  of  improving  the  human  capital  necessary  to  achieve  audit 
readiness,  not  all  CPAs  have  the  requisite  audit  readiness  expertise.®® 
For  example,  CPAs  who  specialize  in  areas  such  as  tax,  budgets,  or 
information  systems  may  not  have  developed  the  tools  necessary  to 
productively  participate  in  improving  audit  readiness.  CPAs  who  have 
federal  financial  statement  audit  experience  are  trained  to  apply  the 
judgment  required  by  generally  accepted  government  auditing  standards 
to  determine  the  relevancy  and  sufficiency  of  controls  and  documentation 
necessary  to  successfully  prepare  DOD  for  a  financial  statement  audit. 

DOD  Actions:  According  to  DOD  officials,  DOD  uses  the  expertise  of 
CPAs  both  as  employees  and  contractors.  The  FIAR  Directorate,  within 
the  Office  of  the  Under  Secretary  (Comptroller),  maintains  a  contractor 
staff  of  CPAs  with  financial  audit  experience.  Among  other  things,  these 


®®Gladys  J.  Commons,  Assistant  Secretary  of  the  Navy  for  Financial  Management,  Is  the 
Financial  Management  Workforce  Positioned  to  Achieve  DOD’s  Financial  Improvement 
Goals?,  testimony  before  the  House  Committee  on  Armed  Services,  Panel  on  Defense 
Financial  Management  and  Auditability  Reform,  112th  Cong.,  1st  sess.,  October  6,  2011. 

®^JoAnn  Boutelle,  Deloitte  &  Touche  LLP,  Industry  Perspectives  on  Achieving  Audit 
Readiness,  testimony  before  the  House  Committee  on  Armed  Services,  Panel  on  Defense 
Financial  Management  and  Auditability  Reform,  112th  Cong.,  1st  sess.,  November  17, 
2011. 

®®Mark  Keeley,  PricewaterhouseCoopers,  LLP,  Department  of  Defense  Audit  Impediments 
and  Audit  Readiness  Testimony,  testimony  before  the  House  Committee  on  Armed 
Services,  Panel  on  Defense  Financial  Management  and  Auditability  Reform,  112th  Cong., 
1st  sess.,  November  17,  2011. 
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CPAs  provide  consulting  services,  including  determining  hov/  to 
implement  best  business  practices  that  are  used  in  the  private  sector.  The 
military  departments  have  also  contracted  with  I  PA  firms.  For  example, 
officials  stated  that  the  Air  Force  has  contracted  a  recognized  accounting 
firm  with  both  auditing  and  audit  readiness  experience  as  its  advisory  and 
assistance  services  contractors.  According  to  Navy  officials,  the  Navy 
perceives  a  continued  need  to  leverage  private  sector  expertise  in  future 
years  to  support  its  FIAR  efforts  and  has  developed  a  flexible  acquisition 
strategy  to  facilitate  this  leveraging  of  expertise.  According  to  Army 
officials,  the  Army  recognizes  the  importance  of  a  variety  of  skills  that  are 
critical  to  accomplish  the  needed  changes  associated  with  audit 
readiness,  including  individuals  with  knowledge  of  the  Army,  audit  and 
systems  experience,  and  with  certifications  such  as  CPAs,  certified 
information  systems  auditors,  and  project  management  professionals. 

The  Army  has  a  mix  of  these  skills  on  its  civilian  audit  readiness  staff  and 
supplements  this  knowledge  base  with  contractor  staff.  The  service 
providers  are  also  using  the  expertise  of  I  PA  firms.  DFAS  has  employed 
multiple  IPA  firms  to  conduct  its  audit  readiness  efforts,  including  IPA 
firms  to  perform  a  mock  military  pay  SSAE  No.  16  examination  as  well  as 
its  first  SSAE  No.  16  examination.  DLA  is  leveraging  an  IPA  firm  as  audit 
readiness  advisors,  which  supports  its  audit  readiness  efforts  with  CPAs 
as  well  as  audit  and  advisory  professionals  experienced  in  financial 
statement  audit  and  information  technology  audit. 

GAO  Status:  We  believe  DOD’s  actions  have  met  the  requirements  of 
the  recommendation. 


Panel  recommendation  3.3 

The  Department  should  develop  and  implement  effective  financial  training  programs  for 
personnel  serving  in  functional  communities  outside  of  the  financial  management 
community. 

GAO  status:  Met 
DOD  status:  Met 

Sources:  House  Armed  Services  Committee  Panel  on  Defense  Rnandal  Management  and  Auditability  Reform,  Findings  and 
Recommendations  (Washington,  O.C.:  Jan.  24, 2012);  D^>artment  of  Defense  (FIAR  Plan  Status  Report,  May  2015);  and  (MO 
(analysis).  |  C5AO-15-463 

Background:  In  its  report,  the  panel  recognized  the  importance  of  having 
personnel  within  DOD’s  functional  communities,  other  than  financial 
management,  with  the  skills  to  perform  financial  management-related 
tasks.  According  to  the  panel,  functional  communities,  such  as  the 
logistics  and  acquisitions  communities,  generate  and  maintain  financial 
information  critical  to  reporting  the  financial  results  of  DOD  operations 
accurately  and  reliably.  For  example,  logistics  personnel  are  responsible 
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for  entering  asset  information  into  inventory  records,  conducting 
inventories,  and  performing  reconciliations.  Acquisition  personnel  enter 
obligations  for  contracts  into  the  accounting  system.  The  panel  concluded 
that  the  department  must  ensure  that  these  personnel  receive  financial 
management  training  as  part  of  the  department’s  FIAR  efforts. 

DOD  Actions:  According  to  DOD  Human  Capital  and  Resource 
Management  officials,  FIAR  courses  are  available  online  for  members  of 
all  DOD  functional  communities,  including  members  of  the  financial 
management  community.  Specifically,  DOD  officials  stated  that  the 
department  has  developed  over  50  web-based  financial  management 
courses,  and  these  courses  provide  credit  applicable  to  the  department’s 
Financial  Management  Certification  Program  requirements  at  the  various 
levels.  While  one  learning  platform  is  restricted  to  members  of  the 
financial  management  community,  the  web-based  courses  on  another 
platform  are  open  to  both  members  of  the  financial  management 
community  and  members  of  other  functional  communities.  Course 
evaluations  are  required  for  each  web-based  course  completed  and  these 
evaluations  are  reviewed  monthly.  According  to  DOD  officials,  course 
evaluation  averages  are  analyzed  and  tracked  and  used  to  evaluate 
training  effectiveness.  DOD  officials  have  stated  that  DOD  has 
consistently  maintained  an  average  course  evaluation  metric  of  4.12  on  a 
5.0  scale  for  these  courses. 

GAO  Status:  We  believe  DOD’s  actions  have  met  the  requirements  of 
the  recommendation. 


Panel  recommendation  3.4 

The  Department  should  develop  and  implement  effective  ERP  training  programs  for 
personnel  within  and  outside  of  the  financial  management  community  who  utilize,  or  will 
be  expected  to  utilize,  an  ERP  system  in  their  day-to-day  operations.  In  developing  these 
training  programs,  the  Department  should  implement  lessons  learned  from  previous 
training  provided  to  ERP  users. 

GAO  status:  Met 
DOD  status:  Met 

Sources:  House  Armed  Services  Committee  Panel  on  Defense  Rnandal  Management  and  Auditability  Reform,  Findings  and 
RecommeruJatiions  (Washington,  D.C.:  Jan.  24, 2012);  Department  of  Defense  (FIAR  Plan  Status  Report  May  2015);  and  C5AO 
(analysis).  |  6AO-15463 


Background:  In  its  report,  the  panel  stated  that  implementing  effective 
training  programs  will  be  especially  important  as  DOD  transitions  to 
increased  use  of  ERP  systems.  For  example,  the  Army  testified  that  its 
General  Fund  Enterprise  Business  System  (GFEBS)  requires  personnel 
to  obtain  proficiencies  in  skills  that  are  not  required  in  the  legacy 
operating  environment  and  that  many  of  the  more  than  70,000  eventual 
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users  of  GFEBS  will  not  reside  in  the  Army’s  financial  management 
community.  The  Army  added  that  the  majority  of  users  operate  among  the 
acquisition,  logistics,  public  works,  and  property  management  functions. 
The  Air  Force  testified  that  its  financial  managers  are  learning  about  new 
ERP  systems,  including  what  these  systems  are  designed  to  do  and  how 
to  work  within  them.®®  The  Air  Force  is  experiencing  a  major  cultural 
change  for  much  of  its  workforce  by  moving  from  primarily  a  bookkeeping 
financial  management  system  to  ERP  systems  that  can  produce  auditable 
financial  statements.  Officials  added  that  the  Air  Force  is  working  to  get 
ahead  of  the  ERP  deployments  and  is  retooling  its  workforce. 

DOD  Actions:  In  the  May  2015  FIAR  Plan  Status  Report,  DOD  stated 
that  training  exists  for  all  current  ERP  systems.  Officials  added  that  these 
training  programs  are  coordinated  with  each  ERP  system  owner  and  the 
component’s  financial  management  office.  In  addition,  the  military 
departments  require  users  to  complete  training  prior  to  obtaining  access 
to  the  ERP  systems.  For  example,  for  its  Defense  Enterprise  Accounting 
and  Management  System  (DEAMS),  the  Air  Force  has  a  library  of  online 
training  courses  that  must  be  taken  as  part  of  the  process  to  request 
access  to  DEAMS.  In  addition,  the  Air  Force  has  included  user  job  aids  in 
DEAMS  that  provide  video  demonstrations  of  common  system  functions. 
According  to  an  Air  Force  official,  the  lack  of  well-geared  training  was 
identified  as  an  underlying  cause  for  earlier  issues  that  occurred  during 
the  DEAMS  implementation  process  because  users  performing  everyday 
business  tasks  with  DEAMS  did  not  have  a  clear  understanding  of  how  to 
use  the  ERP  to  perform  these  tasks.  Army  officials  stated  that  while 
GFEBS  was  being  deployed,  its  GFEBS  training  team  provided  on-site 
and  classroom  training  for  end  users,  and  that  over  the  years, 
improvements  were  made  to  the  tools  provided  and  the  courses.  For 
example,  the  new  job  aids  were  improved  as  well  as  the  scenario-specific 
training,  based  on  lessons  learned  and  feedback  from  the  end  users  and 
the  help  desk.  For  the  Navy  ERP,  a  Navy  official  stated  that  users  must 
complete  web-based  training  or  instructor-led  training  prior  to  obtaining 


®®Jamie  M.  Morin,  Assistant  Secretary  of  the  Air  Force  (Financial  Management  and 
Comptroller),  Is  the  Financial  Management  Workforce  Positioned  to  Achieve  DOD’s 
Financial  Improvement  Goals?,  testimony  before  the  Flouse  Committee  on  Armed 
Services,  Panel  on  Defense  Financial  Management  and  Auditability  Reform,  112th  Cong., 
1st sess.,  Octobers,  2011. 
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access  to  perform  financial  roles. The  Navy,  according  to  this  official, 
has  web-based  training  and  detailed  knowledge-sharing  content  available 
as  part  of  the  overall  Navy  ERP  program,  but  not  uploaded  to  the  Navy 
ERP  application  itself. 

The  military  departments  measure  the  effectiveness  of  this  training  in 
several  ways,  including  end-of-course  surveys  and  analysis  of  help  desk 
tickets,  to  identify  any  gaps  in  training  that  need  to  be  addressed.  For 
example,  for  GFEBS,  the  Army  Financial  Management  School  requires 
end  users  to  complete  end-of-course  evaluations.®®  Air  Force  officials 
provided  an  example  in  which  lessons  learned  and  feedback  from  users 
resulted  in  changes  to  one  of  its  DEAMS  courses.  During  the  June  2014 
deployment  training  cycle,  end  users  noted  that  the  DEAMS  program 
needed  to  adjust  its  project  billing  user  reimbursement  course  to  more 
closely  align  it  with  the  typical  scenarios  and  data  combinations 
experienced  at  most  bases.  According  to  Air  Force  officials,  given  this, 
the  DEAMS  training  team  coordinated  with  the  subject  matter  experts  to 
reevaluate,  adjust,  and  update  the  project  billing  user  reimbursement 
course  material  to  better  support  those  end  users’  needs.  According  to  a 
Navy  official.  Navy  ERP  training  uses  several  sources  of  information  to 
continually  improve  the  effectiveness  of  the  training  material,  including 
lessons  learned  from  student  course  evaluations,  feedback  from  the  end 
user  community  on  topics  where  additional  training  may  be  needed,  and 
analyzing  help  desk  tickets  for  indications  of  training  gaps. 

GAO  Status:  We  believe  DOD’s  actions  have  met  the  requirements  of 
the  recommendation. 


®^As  an  example  of  a  financial  role,  the  Navy  official  described  the  invoice  processing  role, 
which  allows  the  user  to  view  purchase  orders,  create  invoices,  cancel  invoices,  and 
release  blocked  invoices.  According  to  this  official,  access  to  financial  roles  is  not  granted 
until  web-based  or  instructor-led  training  is  confirmed  as  successfully  completed  for  that 
user.  The  completion  of  the  web-based  training  is  confirmed  by  the  system  and 
completion  of  instructor-led  training  is  reported  by  the  instructor. 

®®With  the  full  implementation  of  GFEBS,  the  Army  Financial  Management  School  has 
assumed  responsibility  for  GFEBS  training  and  training  materials. 
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Panel  recommendation  3.5 

The  Department  should  develop  its  proposal  for  an  exchange  program  between  the  DOD 
and  the  private  sector.  In  doing  so,  the  Department  should  develop  specific  criteria, 
regarding  the  personnel  to  be  exchanged  and  the  organizations  that  would  participate. 
The  Department  should  then  submit  its  proposal  to  the  congressional  committees  of 
jurisdiction  for  consideration. 

GAO  status:  Met 
DOD  status:  Met 

Sources;  House  Armed  Services  Convnittee  Parcel  on  Defense  Rnandal  Management  and  Auditability  Reform,  Findings  and 
Recommendations  (Washington.  D.C.:  Jan.  24, 2012);  Department  of  Defense  (FIAR  Plan  Status  Report  May  2015);  and  GAO 
(analysis).  |  (^0-15-463 

Background:  DOD  testified,  before  the  panel,  that  it  would  like  to 
implement  a  pilot  program  similar  to  the  Information  Technology 
Exchange  Program.  According  to  DOD  officials,  the  National  Defense 
Authorization  Act  (NDAA)  for  Fiscal  Year  2010  authorized  a  pilot  program 
for  the  temporary  exchange  of  information  technology  personnel  between 
DOD  and  the  private  sector.  DOD  officials  asserted  that  a  similar 
exchange  program  involving  the  FIAR  Directorate  would  benefit  the 
department’s  FIAR  Plan  through  the  sharing  of  best  practices,  partnering 
to  address  common  challenges,  and  enhancing  competencies.  In  its 
report,  the  panel  stated  that  it  supports  improving  workforce 
competencies  and  therefore  welcomes  the  sharing  of  greater  detail  on  the 
proposed  program  with  the  committee. 

DOD  Actions:  On  April  1 , 2014,  DOD  submitted  a  proposal  for  a  pilot 
Financial  Management  Exchange  Program  between  DOD  and  the  private 
sector  to  both  HASC  and  the  Senate  Armed  Services  Committee  for  their 
consideration.  The  pilot,  proposed  for  inclusion,  but  not  enacted  as  part  of 
the  Carl  Levin  and  Howard  P.  “Buck”  McKeon  NDAA  for  Fiscal  Year 
2015,  was  modeled  on  section  1 1 10  of  the  2010  NDAA,  authorizing  a 
pilot  program  for  the  temporary  exchange  of  personnel  working  in 
information  technology.  According  to  the  proposal,  a  DOD  employee 
would  be  eligible  for  the  exchange  program  only  if  the  employee  (1)  works 
in  financial  management,  (2)  is  considered  to  be  an  exceptional 
employee,  and  (3)  is  compensated  at  least  at  the  General  Schedule  1 1 
grade  level  (or  equivalent).  According  to  DOD  officials.  Senate  Armed 
Services  Committee  members  expressed  their  support  for  the  program 
during  an  April  2014  DOD  briefing  on  this  topic.  However,  in  the  May 
2015  FIAR  Plan  Status  Report,  DOD  officials  stated  that  the  department 
has  not  yet  received  any  formal  comments  from  either  HASC  or  the 
Senate  Armed  Services  Committee  on  its  proposal.  The  legislative 
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proposal  was  included  in  the  Senate  version  of  the  NDAA  for  Fiscal  Year 
2016.®®  However,  DOD  officials  said  they  were  told  in  July  2015  that 
HASC  will  not  be  proceeding  v/ith  this  proposal. 

GAO  Status:  We  believe  DOD’s  actions  have  met  the  requirements  of 
the  recommendation. 


ERP  System 
Implementation  Efforts 


Sources;  House  Armed  Services  Committee  Panel  on  Defense  Rnandal  Management  and  Auditability  Reform.  Fmdings  and 
Recommendations  (Washington.  D.C.:  Jan.  24, 2012);  Department  of  Defense  (FIAR  Plan  Status  Report,  May  2015);  and  GAO 
(analysis).  |  GAO-15463 


Panel  recommendation  4.1 

The  Department  should  include  additional  details  on  ERP  programs  in  the  FIAR  Plan 
Status  Reports,  including  full  deployment  dates,  when  known,  and  key  milestone  dates. 
These  status  reports  should  describe  the  risks  and  potential  consequences  of;  (1)  failing 
to  satisfy  outstanding  ERP  functionality  requirements:  or  (2)  incurring  future  ERP 
milestone  delays.  The  status  reports  should  describe  the  mitigation  measures  taken  by 
the  Department  to  reduce  these  risks.  The  status  reports  should  also  explain  any  actual 
schedule  slippages  or  cost  increases  and  the  actions  taken  by  the  DOD  to  remedy  any 
such  development. 

GAO  status:  Partially  met 
DOD  status:  Partially  met 


Background:  In  its  report,  the  panel  stated  that  ERP  implementation  is 
instrumental  to  resolving  DOD’s  financial  management  weaknesses  and 
achieving  audit  readiness  and  included  a  table  that  showed,  by  military 
department,  the  ERP  systems  that  are  critical  to  Wave  2  and  Wave  3.^° 
The  panel  noted  that  although  information  was  provided  for  select  ERP 
systems  in  the  May  2011  FIAR  Plan  Status  Report,  full  deployment  dates 
were  not  included  for  certain  ERP  systems.  For  example,  the  panel  noted 
that  the  Air  Force  did  not  provide  a  full  deployment  date  for  the 
Expeditionary  Combat  Support  System  (ECSS),  which  was  needed  for  its 
SBR  and  mission-critical  assets  existence  and  completeness  audit.^^ 


®®The  Senate  version  of  the  NDAA  for  Fiscal  Year  2016  includes  a  pilot  program  on  the 
temporary  exchange  of  financial  management  and  acquisition  personnel.  S.  1376,  §  1112. 

^®The  table  was  based  on  information  in  the  May  2010  FIAR  Plan  Status  Report. 

^^ECSS  was  canceled  per  an  Acquisition  Decision  Memorandum  dated  December  11, 
2012,  following  the  Air  Force’s  cancellation  recommendation  made  on  November  14, 
2012.  One  of  the  root  causes  for  the  ECSS  cancellation  was  that  the  Air  Force  did  not 
adequately  understand,  define,  and  document  its  current  business  processes,  nor  did  it 
internally  understand  and  define  the  new  To  be”  business  processes. 
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DOD  Actions:  According  to  the  May  2015  FIAR  Plan  Status  Report,  DOD 
officials  agreed  with  the  panel  that  the  FIAR  Plan  Status  Reports  should 
include  more  detail  regarding  the  ERP  programs  to  better  evaluate 
progress  toward  auditability  and  timely  implementation  of  corrective 
measures  and  increase  confidence  in  the  management  of  the 
department’s  investments  in  ERP  systems.  Consequently,  DOD  has 
included  separate  sections  with  information  on  ERP  systems  and  audit 
readiness,  starting  with  the  November  2012  FIAR  Plan  Status  Report  and 
through  its  November  2014  report.  For  its  May  2015  FIAR  Plan  Status 
Report,  the  information  on  ERP  systems  and  audit  readiness  was 
included  in  a  section  on  the  information  technology  systems  critical  to 
audit  readiness.  Additional  information  that  has  been  provided  in  the  FIAR 
Plan  Status  Reports  includes  (1)  overview  of  the  ERP  systems, 

(2)  program  cost,  (3)  impact  on  legacy  systems,  (4)  information 
technology  controls,  (5)  implementation  milestones  and  audit  readiness 
information,  (6)  financial  reporting  impact,  and  (7)  status  of  financial 
reporting  objectives  by  assessable  unit.  While  the  department  has 
considered  including  additional  risk  management  and  remediation  action 
information  in  the  FIAR  Plan  Status  Reports,  DOD  officials  have  found 
that  the  most  effective  reporting  of  the  specific  risks  and  potential 
consequences  of  failure  to  meet  ERP  functionality  requirements  is 
achieved  through  the  acquisition  governance  and  oversight  reporting. 

With  regard  to  acquisition  governance,  the  department  is  managing  its 
business  systems,  including  ERP  systems,  as  portfolios  of  investments. 
The  goal  is  to  aggregate  data  from  authoritative  data  sources  and  tools  to 
track  and  manage  the  overall  performance  of  systems  portfolios,  including 
ERP  systems.  For  effective  control,  planning,  mitigation,  and  remediation, 
the  department  manages  risk  as  part  of  acquisition  oversight  for  each  of 
the  ERP  systems. 

GAO  Status:  We  consider  this  recommendation  partially  met  because 
DOD  still  needs  to  include  risks  and  potential  consequences  of  failing  to 
satisfy  outstanding  ERP  functionality  requirements  or  incurring  future 
milestone  delays  and  related  mitigation  measures  in  the  FIAR  Plan  Status 
Reports.  Moreover,  the  department  still  needs  to  provide  information  on 
actual  schedule  slippages,  cost  increases,  or  both.  While  the  existence  of 
these  risks  and  the  resulting  effects  on  audit  readiness  may  be  known  to 
DOD  management,  external  readers  of  the  FIAR  Plan  Status  Reports, 
including  those  with  oversight  responsibility,  do  not  have  an  accurate 
picture  of  how  much  DOD’s  financial  auditability  efforts  rely  on  ERP 
systems. 
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Panel  recommendation  4.2 

The  ERP  program  offices  should  integrate  FIAR  milestones  into  their  program 
schedules.  ERP  program  managers  should  be  evaluated  on  their  ability  to  maintain  FIAR 
milestones  as  well  as  program  acquisition-related  milestones. 

GAO  status:  Partially  met 
DOD  status:  Partially  met 

Sources:  House  Armed  Services  Committee  Panel  on  Defense  Financial  Management  and  Auditability  Refonn.  Findings  and 
Recomme/xfafions  (Washington.  O.C.:  Jan.  24, 2012);  Department  of  Defense  (FIAR  Plan  Status  Report,  May  2015);  and  GAO 
(analysis).  |  GAO-15-463 

Background:  The  panel  stated  that  it  was  concerned  about  reported 
ERP  schedule  delays  and  cost  overruns  because  the  ERP  systems  are 
critical  to  (1)  resolving  DOD’s  financial  management  weaknesses  and 
(2)  achieving  audit  readiness. 

DOD  Actions:  According  to  the  military  departments,  their  ERP  program 
offices  are  integrating  FIAR  requirements  and  corresponding  milestones 
into  the  ERP  schedules  through  their  normal  process  of  requirements 
identification  and  technical  solution  development.  According  to  the 
Director,  Business  Integration,  Office  of  the  Deputy  Chief  Financial 
Officer,  the  FIAR  requirements  are  incorporated  into  the  master  set  of 
functional  needs,  business  operations,  and  technical  requirements  and 
appropriately  integrated  into  the  master  program  schedules  in  order  to 
meet  the  overall  program  scope  and  function.  Moreover,  ERP  program 
managers  are  accountable  to  their  respective  departments,  services,  and 
agency  organizations,  and  as  such,  their  performance  is  evaluated 
through  the  plans  and  performance  objectives  established  within  those 
operations  and  business  functions. 

In  its  May  2015  FIAR  Plan  Status  Report,  DOD  officials  stated  that  each 
ERP  system  program  office  is  responsible  for  including  all  requirements, 
including  FIAR  requirements,  in  its  program  schedules  for  its  ERP 
system.  According  to  the  report,  the  military  departments  have  self- 
reported  that  they  have  included  FIAR  milestones  and  requirements  in 
their  schedules  for  those  ERP  systems  still  in  the  acquisition  process, 
such  as  the  Defense  Agencies  Initiative  and  the  Air  Force’s  DEAMS.^^ 


^^The  Defense  Agencies  Initiative  is  intended  to  modernize  the  financial  management 
processes  of  defense  agencies  by  streamlining  financial  management  capabilities  and 
transforming  the  budget,  finance,  and  accounting  operations.  According  to  DOD,  the 
Defense  Agencies  Initiative  is  the  primary  accounting  system  used  by  1 1  defense 
agencies,  with  additional  deployment  in  fiscal  year  2016  and  fiscal  year  2017. 
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ERP  system  programs  that  are  in  the  development  phases  have  been 
given  the  FIAR  requirements  to  include  in  the  program  schedules. 

In  the  May  2015  FIAR  Plan  Status  Report,  DOD  officials  added  that  the 
Office  of  the  Under  Secretary  of  Defense  (Comptroller)  has  developed  a 
methodology  to  include  audit  readiness  in  the  Investment  Decision 
Memorandum  and  the  Acquisition  Decision  Memorandum.  As  stated  in 
the  report,  during  the  Investment  Decision  Memorandum  process,  and  for 
all  systems  that  affect  financial  reporting,  the  Office  of  the  Deputy  Chief 
Financial  Officer  v/ill  provide  input  on  each  investment  decision  approval. 
The  approval  decision  for  each  investment  decision  v^^ill  depend  on  the 
DOD  component’s  demonstration  that  audit  readiness  and  related 
compliance  considerations  have  been  included  in  the  work  products  for 
each  ERP.  In  addition,  according  to  the  report.  Acquisition  Decision 
Memorandums  represent  important  checkpoints  in  the  life  cycles  of  DOD 
systems  and  are  critical  to  ensuring  that  the  expected  outcomes  are 
realized.  Further,  according  to  the  report,  for  those  systems  that  affect 
financial  reporting,  the  Office  of  the  Deputy  Chief  Financial  Officer 
provides  input  for  each  acquisition  decision  approval  at  each  business 
capability  life  cycle  milestone. 

GAO  Status:  DOD  officials  have  stated  that  the  department  has  taken 
actions  to  integrate  FIAR  milestones  into  ERP  program  schedules  and 
hold  program  managers  accountable  throughout  the  life  cycles  of  the 
ERP  systems.  However,  we  consider  this  recommendation  partially  met 
because,  for  ERP  programs  that  are  still  in  the  development  phases,  each 
program  office  must  still  incorporate  the  provided  FIAR  requirements  into 
its  program  schedule  as  recommended  by  the  panel.  Moreover,  the  ERP 
program  managers  still  need  to  be  continually  evaluated  on  their  ability  to 
maintain  FIAR  milestones  as  well  as  program  acquisition-related 
milestones  as  recommended  by  the  panel.  These  two  actions  will  need  to 
continue  until  DOD  has  completed  its  FIAR  Plan  audit  readiness 
activities. 


Panel  recommendation  4.3 

The  Department  should  develop  ERP-related  schedule  and  cost  estimates  based  on 
best  practices  for  future  ERP  deployments. 

GAO  status:  Partially  met 
DOD  status:  Partially  met 

Sources:  House  Armed  Services  Committee  Panel  on  Defense  Financial  Management  and  Auditability  Reform,  Findings  and 
Recommendations  (Washington.  D.C.:  Jan.  24. 2012);  Department  of  Defense  (FIAR  Ran  Status  Report  May  2015);  and  GAO 
(analysis).  |  (3AO-15463 
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Background:  In  its  report,  the  panel  expressed  its  concern  about 
reported  ERP  schedule  delays  and  cost  overruns  and  questioned  whether 
ERP  schedule  and  cost  estimates  were  reliable.  The  panel’s  statements 
were  partly  based  on  our  October  2010  report  in  which  we  stated  that  the 
department  had  identified  nine  ERP  systems  under  development  as 
critical  to  transforming  the  department’s  business  operations  and 
addressing  some  of  its  long-standing  weaknesses. The  panel  stated 
that  our  analysis  of  the  schedules  and  cost  estimates  for  four  ERP 
programs — DEAMS,  ECSS,  GFEBS,  and  the  Army’s  Global  Combat 
Support  System  (GCSS-Army) — ^found  that  none  of  the  programs  were 
fully  following  best  practices  for  developing  reliable  schedules  and  cost 
estimates.  More  specifically,  none  of  the  programs  had  developed  a  fully 
integrated  master  schedule  that  reflected  all  activities,  including  both 
government  and  contractor  activities. In  addition,  none  of  the  programs 
established  a  valid  critical  path  or  conducted  a  schedule  risk  analysis.^® 

DOD  Actions:  In  the  May  2015  FIAR  Plan  Status  Report,  DOD  officials 
stated  that  the  department  agrees  that  better  methods  are  needed  for 
estimating  ERP  implementation  costs  and  scheduling.  However,  DOD 
officials  added  that  the  department’s  experience  with  these  programs 
over  the  past  10  years,  along  with  industry  best  practices,  has  helped 
shape  the  strategies  that  are  now  being  used  in  the  management  and 
oversight  of  ERP  implementations,  including  the  following,  among  others: 


^^GAO,  DOD  Business  Transformation:  improved  Management  Oversight  of  Business 
System  Modernization  Efforts  Needed,  GAO-1 1-53  (Washington,  D.C.:  Oct.  7,  2010). 

^^An  integrated  master  schedule  is  a  document  that  integrates  the  planned  work  by  the 
government,  contractor,  and  other  key  parties;  the  resources  necessary  to  accomplish  that 
work;  and  the  associated  budget. 

^®A  critical  path  is  the  longest  duration  path  through  a  sequenced  list  of  activities  within  a 
schedule.  A  schedule  risk  analysis  uses  statistical  techniques  to  predict  a  level  of 
confidence  in  meeting  a  completion  date. 
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•  Increasing  discipline  in  requirements  management.^® 

•  Reengineering  business  processes  before  focusing  on  solutions. 

•  Reducing  customizations  to  commercial  software. 

•  Sustaining  leadership  involvement  throughout  the  life  cycle. 

•  Emphasizing  organizational  change  management  to  ensure  that  end 
users  understand  the  impact  to  their  jobs. 

•  Using  end-to-end  processes  to  better  guide  and  constrain  ERP 
development  and  interoperability. 

•  Measuring  business  performance  consistently  to  assess  ERP 
impacts. 

•  Incorporating  portfolio  management  methods  to  make  the  right 
investment  decisions. 

GAO  Status:  We  consider  this  recommendation  partially  met  because, 
while  DOD  has  taken  actions  to  implement  best  practices  in  developing 
reliable  schedule  and  cost  estimates,  issues  remain  and  additional 
actions  are  needed  to  fully  address  the  recommendation.  In  February  and 
September  2014,  we  reported  that  DOD  has  not  fully  implemented  best 
practices  in  its  schedule  and  cost  estimates  for  DEAMS^^  and  GCSS- 
Army,  respectively.^®  We  found  that  the  schedule  for  DEAMS  did  not  meet 


^®Requirements  establish  what  the  system  is  to  do,  how  well  it  is  to  do  it,  and  how  it  is  to 
interact  with  other  systems.  Appropriate  requirements  development  involves  eliciting  and 
developing  customer  and  stakeholder  requirements  and  analyzing  them  to  ensure  that 
they  will  meet  users’  needs  and  expectations.  It  also  consists  of  validating  requirements 
as  the  system  is  being  developed  to  ensure  that  the  final  system  to  be  deployed  will 
perform  as  intended  in  an  operational  environment.  The  inclusion  of  too  many 
requirements  can  make  ERPs  more  complicated  than  needed;  too  few  requirements  may 
result  in  ERPs  that  do  not  provide  the  needed  functionality. 

^^GAO,  DOD  Business  Systems  Modernization:  Air  Force  Business  System  Scheduie  and 
Cost  Estimates,  GAO-14-152  (Washington,  D.C.:  Feb.  7,  2014). 

7ft 

GAO,  DOD  Business  Systems  Modernization:  Additionai  Enhancements  Are  Needed  for 
Army  Business  System  Scheduie  and  Cost  Estimates  to  Fuity  Meet  Best  Practices, 
GAO-14-470  (Washington,  D.C.:  Sept.  30,  2014). 
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best  practices,  although  the  cost  estimate  did  meet  best  practices/®  We 
reported  that  the  issues  associated  with  the  schedule  could  negatively 
affect  the  cost  estimate.  For  example,  if  there  are  schedule  slippages,  the 
costs  for  the  program  could  be  greater  than  currently  estimated.  DOD 
officials  concurred  with  our  recommendation  that  DOD  consider  and 
make  any  necessary  adjustments  to  the  DEAMS  cost  estimate  after 
addressing  our  prior  recommendation  to  adopt  scheduling  best 
practices.®®  In  our  review  of  the  schedule  and  cost  estimates  for  GCSS- 
Army,  we  reported  that  while  the  Army  had  made  some  improvements  to 
the  schedule  and  cost  estimates  that  supported  the  full  deployment 
decision,®^  the  Army  did  not  fully  meet  best  practices  in  developing  cost 
and  schedule  estimates  for  GCSS-Army  and  we  recommended  corrective 
actions  with  which  DOD  concurred.®^ 


Panel  recommendation  4.4 

The  Department  should  evaluate  changes  to  ERP  requirements  as  those  systems  are 
developed,  implemented,  and  utilized. 

GAO  status:  Partially  met 
DOD  status:  Partially  met 

Sources:  House  Armed  Services  Committee  Panel  or  Defense  Rnandal  Management  and  Auditability  Reform,  Findings  and 
Recommendafions  (Washington,  D.C.:  Jan.  24, 2012);  Department  of  Defense  (FIAR  Plan  Status  Report  May  2015);  and  GAO 
(analysis).  |  GAO-15-463 


Background:  The  panel  made  this  recommendation  based  on  testimony 
that  the  issues  surrounding  changes  to  systems  requirements  are  the 
cause  of  delays  in  ERP  implementation.  The  panel  noted  in  its  report  that 
the  requirements  process  tends  to  be  underinclusive  or  overinclusive. 
Including  too  many  requirements  can  make  ERP  systems  more 
complicated  than  needed;  too  few  requirements  may  result  in  ERP 
systems  that  do  not  provide  the  needed  functionality. 

DOD  Actions:  In  the  May  2015  FIAR  Plan  Status  Report,  DOD  officials 
stated  that  the  department  agrees  that  ERP  requirements  must  be 


^®For  this  February  2014  report,  we  reviewed  the  most  current  schedule  and  cost 
estimates  at  the  time  of  our  review.  These  estimates  supported  DOD's  February  2012 
Milestone  B  decision,  which  determined  that  Investment  In  DEAMS  was  justified, 

®®GAO-11-53. 

®  V  full  deployment  decision  is  the  decision,  following  completion  of  the  operational  test  of 
the  program,  to  scale  up  production,  fielding,  or  both. 

®2gAO-1  4-470. 
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managed  throughout  ERP  development,  both  within  the  program  and 
through  involved  oversight.  DOD  officials  added  that  each  ERP  program 
and  the  related  “customer”  DOD  component  has  experienced  project 
scope  creep  and  user-specific  requirements  that  have  driven  cost  and 
schedule  challenges.  According  to  DOD  officials,  the  lesson  learned  from 
these  experiences  has  been  to  strengthen  management  discipline 
through  change  control  boards  and  engaged  knowledgeable  senior- 
leader  steering  groups.  In  addition,  the  Milestone  Decision  Authority 
(MDA)  monitors  the  programs  at  a  macro  level  for  cost,  schedule,  and 
performance  and  takes  appropriate  actions  to  address  risks. The  MDA 
can  establish  specific  criteria  in  an  Acquisition  Decision  Memorandum 
that  an  ERP  program  manager  must  meet  before  a  program  is  authorized 
to  proceed  to  the  next  phase  of  development  or  limited  or  full  deployment. 
For  example,  the  MDA  signed  two  separate  Acquisition  Decision 
Memorandums  on  April  18,  2014,  that  (1)  identified  decision  criteria  that 
the  Defense  Agencies  Initiative  ERP  must  meet  before  moving  forward 
with  a  limited  deployment  and  (2)  gave  specific  exit  criteria  for  the 
Integrated  Personnel  and  Pay  System-Army  Increment  I  program  to  meet 
before  the  Army  can  fully  deploy  it  to  all  locations.®'^  DOD  officials  stated 
that  each  military  department  has  change  control  boards  and  senior- 
leader  steering  groups  to  control  requirements  for  ERP  systems.  The 
MDA  can  set  specific  criteria  in  an  Acquisition  Decision  Memorandum  that 
must  be  met  by  the  ERP  program  manager  before  the  decision  is  made 
authorizing  a  program  to  proceed  to  (1)  the  next  phase  of  development, 

(2)  limited  fielding,®®  or  (3)  full  deployment. 

GAO  Status:  This  recommendation  is  applicable  to  DOD’s  ongoing  and 
future  ERP  program  efforts,  and  we  consider  it  partially  met  because 
DOD  still  needs  to  evaluate  changes  to  ERP  requirements  as  those 


®®The  MDA  is  the  senior  DOD  official  who  has  overall  authority  to  approve  entry  of  an 
acquisition  program  into  the  next  phase  of  the  acquisition  process  and  is  accountable  for 
cost,  schedule,  and  performance  reporting,  including  congressional  reporting. 

ft4 

The  Integrated  Personnel  and  Pay  System-Army  is  intended  to  provide  a  24-hour,  web- 
based,  integrated  human  resources  system  to  soldiers,  human  resource  professionals, 
combatant  commanders,  personnel  and  pay  managers,  and  other  authorized  Army  users. 
The  system  is  designed  to  serve  all  components  of  the  Army — ^Active,  Reserve,  and 
National  Guard. 

®®Limited  fielding  is  the  deployment  of  a  capability  to  a  limited  number  of  users  to  test  the 
capability  in  an  operational  environment. 
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systems  are  developed,  implemented,  and  utilized,  as  the  panel 
recommended. 


Panel  recommendation  4.5 

The  Department  should  evaluate  its  requirement  process  for  ERP  systems.  The 
Department  should  assess  the  decision-making  process,  regarding  ERP  requirements, 
at  every  level  of  authority.  The  Department  should  then  determine  what,  if  any,  changes 
may  be  needed. 

GAO  status:  Partially  met 
DOD  status:  Partially  met 

Sources:  House  Armed  Services  Committee  Panel  on  Defense  Rnandal  Management  and  Auditability  Reform,  Findings  and 
Recommendatons  (Washington.  O.C.:  Jan.  24, 2012);  Department  of  Defense  (FIAR  Plan  Status  Report  May  201 5);  and  GAO 
(analysis).  |  GAO-15-463 


Background:  As  for  recommendation  4.4,  the  panel  was  concerned  that 
the  requirements  process  was  either  underinclusive  or  overinclusive.  For 
example,  the  Army’s  Chief  Management  Officer  (CMO)  stated  that 
underinclusiveness  contributed  to  delays  in  implementing  GFEBS. 
Conversely,  DOD’s  DCMO  stated  that  there  is  a  tendency  to  overrequire, 
supported  by  an  institutional  mindset  that  there  is  only  one  opportunity  to 
establish  requirements  for  an  ERP. 

DOD  Actions:  According  to  its  May  2015  FIAR  Plan  Status  Report,  DOD 
has  evaluated  and  modified  its  requirement  processes  for  defense 
business  systems.  DOD’s  Business  Capability  Lifecycle,  which  requires 
disciplined  delivery  of  capabilities  to  end  users  in  18  months,  operates 
within  DOD’s  governance  framework  comprising  the  Investment  Review 
Boards  and  Defense  Business  Systems  Management  Committee,  which 
in  turn  advise  the  MDA  for  the  ERP  programs.  Working  through  the  Major 
Acquisition  Information  System  MDA  for  systems,  the  Deputy  Chief 
Financial  Officer  can  ensure  that  requirements  are  being  met.  DOD 
officials  added  that  the  Office  of  the  DCMO  and  the  military  CMOs  will 
continue  to  assess  current  practices  for  governing  requirements  and 
implement  needed  changes. 

GAO  Status:  We  consider  this  recommendation  partially  met  because,  in 
accordance  with  the  panel  recommendation,  DOD  needs  to  continue  to 
assess  the  requirement  decision-making  processes  at  every  level  of 
authority  for  its  ongoing  and  future  ERP  implementation  efforts. 
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Panel  recommendation  4.6 

The  Department  should  establish  risk  mitigation  plans  to  address  actual  and  potential 
weaknesses  or  deficiencies  associated  with  the  development,  implementation,  or 
utilization  of  its  ERP  systems  that  could  affect  the  achievement  of  FIAR  goals.  At  a 
minimum,  each  risk  mitigation  plan  should:  (1)  identify  measures  for  resolving  any  such 
weaknesses  or  deficiencies:  (2)  assign  responsibilities  within  the  Department  to 
implement  such  measures;  (3)  specify  implementation  steps  for  such  measures; 

(4)  provide  timeframes  for  implementing  such  measures;  and  (5)  identify  any  alternative 
arrangements  outside  of  the  ERP  environment  that  may  be  necessary  for  meeting  FIAR 
objectives. 

GAO  status:  Partially  met 
DOD  status:  Partially  met 

Sources:  House  Armed  Services  Committee  Panel  on  Defense  Financial  Management  and  Auditability  Reform.  Findings  and 
Recommendations  (Washington,  D.C.:  Jan.  24, 2012);  Department  of  Defense  (FIAR  Plan  Status  Report,  May  2015);  and  GAO 
(analysis).  |  GAO-15463 

Background:  The  panel  was  concerned  that  ERP  systems  may  not 
provide  the  capabilities  needed  to  achieve  FIAR  objectives.  For  example, 
we  testified  before  the  panel  that  some  ERP  systems  do  not  function  as 
intended.®®  According  to  the  panel’s  report,  if  the  ERP  systems  do  not 
provide  the  intended  capabilities,  DOD  components  must  continue  to  rely 
on  legacy  systems  and  manual  processes.  Therefore,  DOD’s  goals  of 
modernizing  and  streamlining  its  business  processes  and  strengthening 
its  financial  management  capabilities — leading  to  financial  statement 
auditability — could  be  jeopardized. 

DOD  Actions:  According  to  its  May  2015  FIAR  Plan  Status  Report,  DOD 
agrees  with  the  panel  that  effective  information  technology  acquisition 
requires  thorough  risk  management,  including  the  identification,  analysis, 
and  mitigation  of  risks.  DOD  officials  stated  in  the  report  that  its  FIAR 
methodology  identifies  ERP  systems  and  associated  feeder  systems  that 
relate  to  achieving  FIAR  goals.  Each  military  department  has  established 
a  risk  management  approach  in  which  major  risks  are  tracked  and 
mitigation  plans  are  developed  to  identify  measures  for  resolving 
weaknesses  associated  with  the  development,  implementation,  and  use 
of  its  ERP  systems  that  could  affect  the  achievement  of  FIAR  goals. 

Each  of  the  military  departments  reports  on  its  respective  ERP  system 
program,  for  which  it  is  responsible  for  resolving  weaknesses,  at  the 
regularly  scheduled  FIAR  review  sessions.  Officials  from  the  military 


®®GAO,  DOD  Financial  Management:  Challenges  in  the  Implementation  of  Business 
Systems  Could  Impact  Audit  Readiness  Efforts,  GAO-1 2-1 77T  (Washington,  D.C.: 
Oct.  27,  2011). 
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departments  described  the  efforts  to  mitigate  risks  associated  with  ERP 
implementations.  For  example,  Air  Force  officials  stated  that  the  risk 
management  plan  for  DEAMS  describes  a  comprehensive  risk 
management  process.  According  to  Air  Force  officials,  specific  risks 
associated  with  FIAR  compliance  have  been  identified,  are  currently 
being  assessed,  and  will  be  reported  and  tracked  through  the  DEAMS 
risk  management  program. 

According  to  Army  officials,  each  Army  ERP  program  has  developed  its 
own  risk  management  procedure,  based  on  existing  Army  regulations.  In 
addition,  each  Army  ERP  program  has  developed  documentation  on 
applicable  FIAR-related  processes,  risks,  and  controls  to  mitigate  risks. 
The  Army’s  ERP  program  offices  provide  periodic  acquisition  and 
program  reviews  at  the  MDA  level.  These  reviews  include  programmatic 
and  audit-related  risks  associated  with  an  ERP  program  as  well  as  risk 
mitigation  steps  associated  within  the  program.  Army  officials  stated  that 
additional  requirements  and  actions  are  identified  to  mitigate  risk  if  a  risk 
is  outside  of  the  program’s  direct  control. 

Navy  officials  stated  that  its  Enterprise  Business  Solutions  (formerly  the 
Navy  ERP  Program  Office)  has  a  risk  management  program  consisting  of 
two  components:  (1)  the  Risk  Committee,  which  allows  any  individual  to 
bring  a  risk  to  program  leadership’s  attention,  and  (2)  the  Risk  Board, 
which  is  the  program’s  senior  leadership  review  and  mitigation  planning 
forum  for  identified  risks. 

GAO  Status:  DOD  has  developed  risk  mitigation  plans  for  its  ERP 
systems.  However,  we  consider  this  recommendation  partially  met 
because  DOD  and  its  components  need  to  continually  monitor  ERP  and 
FIAR  efforts  to  identify  actual  and  potential  weaknesses  or  deficiencies 
associated  with  developing,  implementing,  and  using  ERP  systems  that 
could  affect  the  achievement  of  FIAR  goals.  Moreover,  DOD  components 
need  to  identify  implementation  steps  and  assign  responsibilities  for  the 
performance  of  these  steps  to  resolve  the  potential  weaknesses  or 
deficiencies,  as  the  panel  recommended.  Further,  time  frames  need  to  be 
established  for  taking  these  steps.  The  identification  of  any  alternative 
arrangements  needed  outside  of  the  ERP  environment  to  meet  FIAR 
objectives  is  critical  to  ensuring  that  a  DOD  component  will  be  able  to 
make  these  arrangements  and  not  hinder  DOD’s  audit  readiness  goals. 
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Panel  recommendation  4.7 

The  Department  should  evaluate  lessons  learned  from  previous  data  conversion  efforts, 
and  it  should  incorporate  these  lessons  into  its  ERP  data  conversion  plans.  The 
Department  should  update  its  ERP  data  conversion  plans  periodically.  Updates  should 
include  assessments  of:  the  progress  made  in  converting  data  into  the  ERP 
environment;  v/hether  that  progress  supports  the  satisfaction  of  existing  requirements: 
and  whether  additional  data  conversion  requirements  would  facilitate  the  achievement  of 
FIAR  objectives.  The  Department  should  also  assess  the  merits  of  designating  a  senior 
official  (such  as  the  CMO  or  the  DCMO)  to  be  responsible  for  the  coordination  and 
managerial  oversight  of  data  conversion. 

GAO  status:  Partially  met 
DOD  status:  Partially  met 

Sources:  House  Armed  Services  Committee  Panel  on  Defense  Financial  Management  and  Auditability  Reform.  Findings  and 
Recommendations  (Washington,  D.C.:  Jan.  24, 2012);  Department  of  Defense  (FIAR  Plan  Status  Report,  May  2015);  and  GAO 
(analysis).  |  GAO-15463 


Background:  In  its  report,  the  panel  stated  that  conversion  of  data  from 
the  legacy  systems  to  the  new  ERP  systems  is  a  difficult  and  challenging 
effort.  The  panel  noted  that  each  military  department  had  taken  its  own 
approach  to  data  conversion  and  expressed  its  concern  that  poor 
execution  of  data  conversion  efforts  could  cause  delays  in  implementing 
ERP  systems. 

DOD  Actions:  In  its  May  2015  FIAR  Plan  Status  Report,  DOD  stated  that 
the  military  departments  have  learned  from  past  experience.  For 
example,  the  Air  Force,  after  its  initial  data  conversion  for  DEAMS  at 
Scott  Air  Force  Base,  decided  not  to  convert  legacy  data  into  DEAMS,  but 
instead  to  use  a  dual-processing  approach.  Under  this  approach,  newly 
initiated  transactions  are  entered  into  DEAMS,  but  transactions  already 
initiated  in  legacy  systems  continue  to  be  processed  in  the  legacy  system 
until  contract  closeout.  The  Director  of  Business  Integration,  Office  of  the 
Under  Secretary  of  the  Comptroller,  stated  that  since  2012,  when  the 
panel  issued  its  report,  data  conversions  from  legacy  systems  to  ERP 
systems  have  become  part  of  standard  protocols  performed  between  an 
individual  ERP  program  office  and  the  deploying  DOD  component  or 
organization.  Data  conversions  to  ERP  systems  focus  on  open 
transactions  only  for  the  purposes  of  providing  matching  transactions 
when  the  disbursements  and  matching  outlays  occur.  According  to  this 
official,  since  2012,  the  data  conversions  for  the  Defense  Agencies 
Initiative  ERP  and  Navy  ERP,  for  example,  have  gone  smoothly.  With 
regard  to  the  panel’s  recommendation  that  DOD  assess  the  merits  of 
designating  a  senior  official  responsibility  for  coordinating  and  overseeing 
data  conversion,  a  DOD  official  stated  that  while  the  recommendation 
may  have  made  sense  in  2012,  when  the  panel’s  report  was  issued,  it  is 
no  longer  relevant  given  the  quality  of  data  conversions  over  the  last  3 
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years  and  the  standard  protocols  used  for  data  conversions  for  each 
individual  ERP  deployment. 

GAO  Status:  DOD  has  evaluated  lessons  learned  from  previous  data 
conversion  efforts  and  considered  these  lessons  in  its  current  data 
conversion  efforts.  However,  we  consider  this  recommendation  partially 
met  because  the  department  will  need  to  periodically  update  its  data 
conversion  plans.  According  to  the  panel,  these  updates  will  need  to 
include  assessments  of  (1)  the  progress  made  in  converting  data  into  the 
ERP  environment,  (2)  whether  that  progress  supports  the  satisfaction  of 
existing  requirements,  and  (3)  whether  additional  data  conversion 
requirements  would  facilitate  achieving  FIAR  objectives. 


Panel  recommendation  4.8 

The  Department  should:  (1)  evaluate  the  causes  of  system  interface  problems: 

(2)  determine  whether  the  number  of  interfaces  can  be  reduced  (e.g.,  by  incorporating 
activities  performed  by  legacy  systems  into  the  ERPs);  and  (3)  determine  what 
improvements  can  be  made  to  support  more  effective  interfaces  between  systems. 

GAO  status:  Partially  met 
DOD  status:  Partially  met 

Sources:  House  Amied  Services  Committee  Parcel  on  Defense  Rnandal  Management  and  Auditability  Reform,  Findings  and 
Recomme/xHafions  (Wasttington,  O.C.:  Jan.  24, 2012);  D^>artinent  of  Defense  (FIAR  Plan  Status  Report,  May  2015);  and  GAO 
(analysis).  |  GAO-15-463 

Background:  In  its  report,  the  panel  stated  that  the  DOD  Deputy  IG 
testified  that  the  numerous  interfaces  between  ERP  systems  and  legacy 
systems  may  be  overwhelming  and  may  not  be  adequately  defined.®^  As 
stated  in  the  panel’s  report,  the  number  of  interfaces  is  driven  by  the 
number  of  legacy  systems.  The  panel  is  concerned  that  problems 
associated  with  these  interfaces  could  be  compromising  functionality. 
According  to  the  panel  report,  DOD  should  make  every  effort  to  reduce 
reliance  on  those  legacy  system  activities  that  can  be  effectively  and 
efficiently  conducted  by  ERP  systems.  The  panel  also  stated  that  DOD 
should  complete  and  validate  its  business  process  reengineering  analysis 
to  ensure  that  those  business  processes  supported  by  the  ERP  systems 
will  be  as  streamlined  and  efficient  as  practicable  and  that  the  need  to 
tailor  ERP  systems  to  meet  unique  requirements  or  to  incorporate  unique 
interfaces  has  been  eliminated  or  reduced  to  the  extent  practicable. 


®^Daniel  Blair,  Deputy  Inspector  General  for  Auditing,  Department  of  Defense  Office  of 
Inspector  General,  DOD’s  Efforts  to  Improve  Payment  and  Funds  Control,  testimony 
before  the  House  Committee  on  Armed  Services,  Panel  on  Defense  Financial 
Management  and  Auditability  Reform,  112th  Cong.,  1st  sess.,  September  22,  2011. 
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DOD  Actions:  According  to  DOD’s  May  2015  FIAR  Plan  Status  Report, 
the  department  is  increasingly  approaching  investment  decisions  with  a 
portfolio  view  to  reduce  or  eliminate  unique  requirements  and  interfaces. 
As  DOD  also  stated  in  that  report,  DOD  has  begun  to  implement  process 
improvements  across  all  systems  by  implementing  key  strategic 
initiatives,  including  its  use  of  the  global  exchange  to  increase  the 
interoperability  and  exchange  of  standardized  data  between  systems.  In 
its  report,  DOD  also  stated  that  there  is  a  strategy  to  reduce  the  number 
of  existing  legacy  systems  over  the  next  several  years,  which  will  lessen 
the  need  for  a  large  number  of  interfaces.  The  military  department  CMOs 
and  the  DCMOs  (for  the  other  defense  organizations)  examine  and 
validate  the  need  for  unique  requirements  and  interfaces  as  they  develop 
their  respective  organizational  execution  plans  in  preparation  for  review 
by  the  Defense  Business  Council. 

GAO  Status:  We  consider  this  recommendation  partially  met  because 
DOD,  through  its  business  process  reengineering,  needs  to  ensure  that 
unique  requirements  and  interfaces  are  reduced  to  the  minimum  extent 
practicable.  As  the  military  departments  and  components  proceed  with 
FIAR  activities  related  to  ERP  systems,  the  organizational  execution  plan 
reviews  and  other  actions  to  implement  these  key  strategic  initiatives  will 
be  critical  in  identifying  the  causes  of  interface  issues,  determining  how 
many  and  which  interfaces  can  be  reduced,  and  the  improvements  that 
can  be  made  to  support  more  effective  interfaces.  Furthermore,  in 
implementing  this  recommendation,  the  department  needs  to  ensure  that 
its  components  are  reengineering  current  business  practices  rather  than 
customizing  commercial  ERP  systems.  For  example,  the  DOD  IG  has 
reported  that  DOD  has  not  reengineered  its  business  processes  to  the 
extent  necessary;  instead,  it  has  often  customized  commercial  ERP 
systems  to  accommodate  existing  business  processes.®®  This 
customization  creates  a  need  for  system  interfaces  and  weakens  controls 
built  into  an  ERP.  The  ERP  systems  were  designed  to  replace  numerous 
subsidiary  systems,  reduce  the  number  of  interfaces,  standardize  data, 
eliminate  redundant  data  entry,  and  provide  an  environment  for  end-to- 
end  business  processes,  while  being  a  foundation  for  sustainable  audit 
readiness.  However,  the  DOD  IG  stated  that  the  numerous  interfaces 
between  the  ERP  systems  and  existing  systems  may  be  overwhelming 


oo 

Department  of  Defense,  Office  of  Inspector  General,  Inspector  General’s  Statement  of 
Management  and  Performance  Challenges  for  Fiscal  Year  2014  (Alexandria,  Va.: 
November  2014). 
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and  inadequately  defined.  Each  interface  presents  a  risk  that  a  system 
might  not  function  as  designed,  and  each  prevents  the  linking  of  all 
transactions  in  an  end-to-end  process. 


Panel  recommendation  4.9 

The  DOD  DCMO,  in  coordination  with  the  Director,  Operationai  Test  and  Evaluation  and 
the  Deputy  Assistant  Secretary  of  Defense  for  Deveiopment  Test  and  Evaluation,  should 
assess  information  system  control  testing  needs  for  all  ERPs  being  developed  by  the 
DOD  and  determine  whether  appropriate  workforce  levels  and  corresponding  skill  sets 
exist  v/ithin  the  Department’s  developmental  and  operational  test  communities.  The 
Department  should  take  actions  to  address  any  identified  shortfalls. 

GAO  status:  Partially  met 
DOD  status:  Partially  met 

Sources;  House  Armed  Servi<^  Committee  Pane)  on  Defense  Financial  Management  and  Auditability  Reform,  Findings  and 
Recommendations  (Washington,  D.C.:  Jan.  24. 2012);  Department  of  Defense  (FIAR  Plan  Status  Report,  May  2015);  and  GAO 
(analysis)  |  GAO-15-463 


Background:  In  its  report,  the  panel  stated  that  the  FIAR  Guidance  calls 
for  the  DOD  components  to  test  information  systems  controls  for  key 
systems  and  processes.  Because  most  financial  information  is  maintained 
in  computer  systems,  the  controls  over  how  those  systems  operate  are 
integral  to  the  reliability  of  financial  data.  For  example,  the  panel  noted 
that  if  auditors  are  able  to  rely  on  information  system  controls,  the  extent 
of  substantive  testing  can  be  significantly  reduced.  According  to  the 
panel,  DOD  should  continue  to  subject  its  systems,  both  legacy  systems 
and  ERP  systems,  to  information  systems  controls  testing,  but  it  must 
also  ensure  that  a  priority  is  placed  on  this  testing  and  that  sufficient 
numbers  of  appropriately  skilled  personnel  exist  within  the  test  and 
evaluation  community.  In  addition,  when  implementing  ERP  systems, 

DOD  should  ensure  that  the  systems  satisfy  the  computer  control 
objectives  established  in  GAO’s  Federal  Information  System  Control  Audit 
Manual. 

DOD  Actions:  According  to  the  May  2015  FIAR  Plan  Status  Report, 
officials  from  the  Office  of  the  Director,  Operational  Test  and  Evaluation 
(OT&E),  do  not  perform  testing  for  all  systems,  but  provide  guidance  to 
assist  organizations  in  performing  testing.  Officials  from  OT&E  stated  that 
assessing  information  system  control  testing  needs  is  difficult  because  of 
the  different  interpretations  of  information  system  controls.  As  a  result  of 
these  inconsistencies,  gaps  exist  in  the  types  of  testing  that  are  actually 


®®GAO,  Federal  Information  System  Controls  Audit  Manual  (FISCAM),  GAO-09-232G 
(Washington,  D.C.:  February  2009). 
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accomplished.  Nevertheless,  OT&E  officials  stated  that  they  are  not 
specifically  concerned  with  testing  individual  information  systems 
controls,  but  rather  that  (1)  a  typical  user  can  perform  operational  tasks 
with  the  production-representative  system  in  an  operationally  realistic 
computing  environment  and  (2)  the  system  has  the  appropriate  computer 
network  defense  capabilities. 

According  to  OT&E  officials,  DOD’s  components  implementing  ERP 
systems,  including  the  military  departments,  are  involved  in  the 
information  systems  control  testing  of  their  ERP  systems  by  developing 
the  test  and  evaluation  master  plans.  According  to  these  officials,  these 
plans,  provided  by  ERP  program  managers  and  approved  by  OT&E 
officials,  specify  appropriate  testing  for  ERP  systems.  For  example.  Navy 
officials  said  that  the  Navy  will  coordinate  with  OT&E  and  others  to 
ensure  that  the  appropriate  workforce  and  skill  sets  have  been  identified 
for  evaluation  and  testing.  OT&E  officials  stated  that  they  anticipate  the 
department’s  increasing  need  to  improve  the  cybersecurity  of  its  ERP 
systems  and  other  programs  and  networks  will  require  increased  test 
resources,  especially  for  cyber  ranges.  According  to  these  officials,  there 
are  three  groups  of  organizations  that  play  a  critical  role  in  the  information 
systems  control  testing  of  ERP  systems. 

1 .  User/requirements  communities.  It  is  critical  for  the  user/requirements 
communities  to  identify  the  specific  ERP  information  systems  control 
requirements  beginning  with  the  request  for  proposal. 

2.  Operational  test  agencies. These  agencies  are  responsible  for 
executing  operational  tests  for  each  ERP. 

3.  ERP  program  managers.  The  program  managers  develop  the  test  and 
evaluation  master  plans  for  approval  from  the  Director,  Operational 
Test  and  Evaluation. 

GAO  Status:  We  consider  this  recommendation  partially  met  because 
OT&E  officials,  in  consultation  with  the  DCMO  and  components,  will  need 
to  continue  assessing  their  role  in  evaluating  information  system  controls 
for  all  ERP  systems  being  deployed  by  the  department  and  examine 
necessary  skill  sets  to  accomplish  such  testing  to  determine  if  additional 


According  to  a  DOD  Independent  Operational  Test  Agency  business  rule,  an 
independent  operational  test  agency  must  be  established  for  each  military  department  to 
plan  and  conduct  operational  tests,  report  results,  and  provide  evaluations  of  effectiveness 
and  suitability.  This  agency  is  to  report  directly  to  the  chief  of  the  military  department. 
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training  is  required  within  the  developmental  and  operational  test 
communities,  as  recommended  by  the  panel.  In  addition,  DOD  has  not 
yet  ensured  the  testing  of  general  and  application  controls  for  its  ERP 
systems  that  are  critical  to  DOD’s  financial  audit  readiness  efforts.  As 
DOD  stated  in  its  May  2015  FIAR  Plan  Status  Report,  the  department 
must  evaluate  and  remediate  controls  for  hundreds  of  information 
technology  systems  that  materially  affect  the  financial  statements  to 
achieve  and  sustain  an  audit  ready  systems  environment.  However, 
additional  actions  are  needed  because  DOD’s  approach  fortesting  ERP 
systems  may  not  result  in  the  benefits  of  testing  envisioned  by  the  panel 
because  the  focus  of  DOD’s  testing  is  based  more  on  the  operational 
capability  of  the  systems  and  their  security  from  attack  than  the  specific 
application  controls  of  the  ERP  systems.®^  For  example,  the  panel  noted 
that  if  auditors  are  able  to  rely  on  information  system  controls,  the  extent 
of  substantive  testing  can  be  significantly  reduced.  Under  DOD’s  broad 
approach,  specific  application  controls  for  ERP  systems  that  affect  the 
information  under  audit  may  not  be  tested. 


Q1 

Application  controls  are  intended  to  provide  reasonable  assurance  of  completeness  (all 
transactions  that  occurred  are  input  into  the  system,  processed  only  once,  and  properly 
included  in  output);  accuracy  (transactions  are  properly  recorded,  with  correct  data  and 
amounts,  in  the  proper  period,  and  are  processed  accurately  and  produce  reliable  results); 
validity  (all  recorded  transactions  actually  occurred,  relate  to  the  organization,  are 
authentic,  and  were  properly  approved,  and  output  contains  only  valid  data);  confidentiality 
(application  data  and  reports  and  other  output  are  protected  against  unauthorized  access); 
and  availability  (application  data  and  reports  and  other  relevant  business  information  are 
readily  available  to  users  when  needed). 
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UNDER  SECRETARY  OF  DEFENSE 
1  1 0O  DEFENSE  PENTAGON 
WASHJNGTON,  DC  20301-1100 


COMPTAOU-ER 

Mr.  Asif  A.  Khan  SEP  1  0  2015 

Director,  Financial  Management  and  Assurance 

U.S.  Government  Accountability  Office 

441  G  Street,  NW 

Washington,  DC  20548 

Dear  Mr.  Khan: 

This  is  the  Department  of  Defense  (DoD)  response  to  the  Government  Accountability 
Office  (GAO)  draft  report  GAO- 1 5-463,  “DoD  Financial  Management:  Continued  Actions 
Needed  to  Address  Congressional  Committee  Panel  Recommendations,”  dated  August  1 1, 2015 
(GAO  Code  197135).  The  Department  acknowledges  receipt  of  the  draft  report  and  concurs 
with  GAO’s  recommendation  to  reconsider  the  status  of  three  panel  recommendations  (1 .6,  2.1, 
and  2.2).  Our  proposed  actions  are  detailed  in  the  enclosure. 

We  appreciate  GAO’s  acknowledgement  of  the  progress  DoD  has  made  toward 
implementing  each  of  the  29  reeommendations  made  by  the  House  Armed  Services  Committee 
(HASC)  Panel  on  Defense  Financial  Management  and  Auditability  Reform.  Of  note  is  the 
impact  of  our  investments  in  a  well-trained  workforce.  The  Department  uses  many  instructional 
forums  to  train  our  financial  workforce  in  support  of  audit  readiness,  and  our  training  initiatives 
have  helped  close  four  of  the  five  HASC  panel  recommendations  related  to  financial  workforce 
management.  Investment  in  workforce  training  programs  will  continue  to  support  preparation 
for  a  full  financial  statement  audit. 

My  office  will  continue  to  provide  status  updates  on  actions  planned  and  completed  for 
the  remaining  23  HASC  panel  recommendations  in  our  semiannual  Financial  Improvement  and 
Audit  Readiness  Plan  Status  Report.  We  look  forward  to  your  continued  support  in  DoD’s 
implementation  of  the  remaining  HASC  recommendations.  My  point  of  contact  for  this  effort  is 
Ms.  Sharon  DePrato,  at  703-695-7000  or  sharon.d.deprato.civ@mail.mil. 

Sincerely, 

Michael  McCord 


Enclosure: 
As  stated 
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Appendix  II:  Comments  from  the  Department 
of  Defense 


GAO  DRAFT  REPORT  DATED  AUGUST  11,  2015 
GAO-15-463  (GAO  CODE  197135) 

“DOD  FINANCIAL  MANAGEMENT:  CONTINUED  ACTIONS  NEEDED  TO 
ADDRESS  CONGRESSIONAL  COMMITTEE  PANEL  RECOMMENDATIONS” 

DEPARTMENT  OF  DEFENSE  RESPONSE 
TO  THE  GAO  RECOMMENDATION 


RECOMMENDATIONS  FOR  EXECUTIVE  ACTION:  To  help  meet  its  financial 
management  improvement  and  audit  readiness  goals,  GAO  recommends  that  the  Secretary  of 
Defense  direct  the  Under  Secretary  of  Defense  (Comptroller)  to  reconsider  the  status  of  the  three 
panel  recommendations  that  DoD  classified  as  met  that  GAO  has  determined  were  partially  met, 
and  take  the  necessary  actions  to  reasonably  assure  these  recommendations  have  been  met. 

DoD  RESPONSE:  DoD  concurs  with  GAO’s  recommendation  to  take  action  in  reconsidering 
the  status  of  the  three  House  Armed  Services  Committee  (HASC)  panel  recommendations  that 
DoD  classified  as  “met”  that  GAO  has  determined  were  “partially  met.”  DoD  will  strengthen  its 
position  and  report  on  the  actions  taken  in  the  November  1 5, 2015,  Financial  Improvement  and 
Audit  Readiness  (FIAR)  Plan  Status  Report.  Plarmed  actions  are  as  follows: 

HASC  Recommendation  1 .6:  DoD  will  require  the  FIAR  Governance  Board 
co-chairmen,  the  senior  executives  representing  the  service  providers,  and  the  chief 
management  officers  for  the  Military  Departments  to  state  their  commitment,  and 
whether  they  are  on  track  to  achieve  the  2017  goal. 

HASC  Recommendation  2.1:  DoD  will  discuss  what  actions  need  to  be  taken  that 
determine  how  to  reward  executives  based  on  evaluated  performance  for  FlAR-related 
goals  or  assess  the  effect  on  accomplishing  FIAR  activities  by  tracking  evaluated 
performances  over  time. 

HASC  Recommendation  2.2:  DoD  will  take  action  to  update  the  FIAR  Guidance  to 
require  dual  signatures  from  both  the  senior  executives  in  charge  of  financial  and  relevant 
functional  areas  for  the  subject  assertions. 
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Appendix  III:  GAO  Contact  and  Staff 
Acknowledgments 


GAO  Contact 


Asif  A.  Khan,  (202)  512-9869  orkhana@gao.gov 


Staff 

Acknowledgments 


In  addition  to  the  contact  named  above,  Michael  S.  LaForge  (Assistant 
Director),  Sandra  S.  Silzer  (Auditor-in-Charge),  and  Laura  S.  Pacheco 
made  key  contributions  to  this  report.  Also  contributing  to  this  report  were 
Doreen  S.  Eng,  Francine  M.  DelVecchio,  Maxine  L.  Mattery,  and  Jared  D. 
Minsk. 


(197135) 


Page  83 


GAO-15-463  HASC  Panel  Recommendations 


GAO’s  Mission 

The  Government  Accountability  Office,  the  audit,  evaluation,  and 
investigative  arm  of  Congress,  exists  to  support  Congress  in  meeting  its 
constitutional  responsibilities  and  to  help  improve  the  performance  and 
accountability  of  the  federal  government  for  the  American  people.  GAO 
examines  the  use  of  public  funds;  evaluates  federal  programs  and 
policies;  and  provides  analyses,  recommendations,  and  other  assistance 
to  help  Congress  make  informed  oversight,  policy,  and  funding  decisions. 
GAO’s  commitment  to  good  government  is  reflected  in  its  core  values  of 
accountability,  integrity,  and  reliability. 

Obtaining  Copies  of 
GAO  Reports  and 
Testimony 

The  fastest  and  easiest  v^ay  to  obtain  copies  of  GAO  documents  at  no 
cost  is  through  GAO’s  v^ebsite  (http://vww.gao.gov).  Each  weekday 
afternoon,  GAO  posts  on  its  website  newly  released  reports,  testimony, 
and  correspondence.  To  have  GAO  e-mail  you  a  list  of  newly  posted 
products,  go  to  http://www.gao.gov  and  select  “E-mail  Updates.” 

Order  by  Phone 

The  price  of  each  GAO  publication  reflects  GAO’s  actual  cost  of 
production  and  distribution  and  depends  on  the  number  of  pages  in  the 
publication  and  whether  the  publication  is  printed  in  color  or  black  and 
white.  Pricing  and  ordering  information  is  posted  on  GAO’s  website, 
http://www.gao.gov/ordering.htm. 

Place  orders  by  calling  (202)  512-6000,  toll  free  (866)  801-7077,  or 

TDD  (202)  512-2537. 

Orders  may  be  paid  for  using  American  Express,  Discover  Card, 
MasterCard,  Visa,  check,  or  money  order.  Call  for  additional  information. 

Connect  with  GAO 

Connect  with  GAO  on  Facebook,  Flickr,  Twitter,  and  YouTube. 

Subscribe  to  our  RSS  Feeds  or  E-mail  Updates. 

Listen  to  our  Podcasts  and  read  The  Watchblog. 

Visit  GAO  on  the  web  at  www.gao.gov. 

To  Report  Fraud, 
Waste,  and  Abuse  in 
Federal  Programs 

Contact: 

Website:  http://www.gao.gov/fraudnet/fraudnet.htm 

E-mail:  fraudnet@gao.gov 

Automated  answering  system:  (800)  424-5454  or  (202)  512-7470 

Congressional 

Relations 

Katherine  Siggerud,  Managing  Director,  siggerudk@gao.gov,  (202)  512- 
4400,  U.S.  Government  Accountability  Office,  441  G  Street  NW,  Room 
7125,  Washington,  DC  20548 

Public  Affairs 

Chuck  Young,  Managing  Director,  youngc1@gao.gov,  (202)  512-4800 

U.S.  Government  Accountability  Office,  441  G  Street  NW,  Room  7149 
Washington,  DC  20548 

O 
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